Release notes

Every Tracon package is cut from one version line, so a release below covers every NuGet package of the family and the npm client at once. Each package’s release-notes metadata links straight to the entry for the version you installed.

Read Versions and upgrades before you move between previews: it carries the pinning rules and the upgrade sequence this page’s entries assume.

Releases

1.0.0-preview.6 — 2026-10-27

Agents and workflows gain the controls a production host needs before the surface freezes. The new Tracon.AGUI package lets a front end that speaks the AG-UI protocol run a Tracon agent. An agent keeps files in a workspace for each session and remembers what its user said in earlier sessions, a tool can ask the user for input in the middle of a call (MCP elicitation), and a workflow waits for a tool approval that a person answers. A callable agent can be pinned to a version, and a version number is never given twice for one name. A spent call-tree budget or tenant cost quota now stops a tool call, a function node or an agent step before it starts; a workflow continuation keeps the budget of the runs before it; and a configuration value Tracon cannot read stops the host at startup. The release adds three migrations to each SQL provider and breaks source in several places: read Upgrading from 1.0.0-preview.5 first.

Upgrading from 1.0.0-preview.5

• Migrations. PostgreSQL 0063–0065, SQL Server 0051–0053 and SQLite 0050–0052. With AutoApplyMigrations (the default) they run at startup. They add the expected_tool_calls column of an eval case, an index on the agent files of a tenant by path, and the agent_definition_version_counters table, which starts the counter of each agent at the version it holds today. No column is dropped. An agent that was deleted and created again before the upgrade keeps only the numbers it holds now (see the IAgentDefinitionStore entry, Changed).
• Public types changed. Each entry below (Changed) says what to do:
  • AgentDefinition.CallableAgentNames and AgentDefinitionRequest.CallableAgentNames are CallableAgents, a list of CallableAgentReference; a body that still carries callableAgentNames is refused with 400.
  • ModelBinding.AllowConcurrentToolCalls is ModelBinding.ToolLoop.AllowConcurrentToolCalls; a body that still carries the old key is refused with 400.
  • EvalCase.ExpectedTools and EvalCaseDraft.ExpectedTools are ExpectedToolCalls; a body that still carries expectedTools is refused with 400.
  • IJobStore.LeaseAsync takes one JobLeaseRequest.
  • A custom IAgentDefinitionStore, IRunStore or IJobStore must pass the new cases of AgentDefinitionStoreContract, RunStoreContract and JobStoreContract.
  • AddSpeechSynthesizer(name, null) and AddSpeechTranscriber(name, null) no longer compile.
  • Tracon.Client: EvalCaseInput.SourceKind and EvalCasePromotionRequest.SourceKind are EvalCaseSource, VoiceSessionRecord.EndReason is VoiceSessionEndReason, and the empty SourceKind2 class is gone (see the nullable enum entry, Fixed).
• Behavior changes most likely to reach an upgrade, each described in its entry below:
  • A configuration value Tracon cannot read stops startup, and so does a list or map key that holds one value. Start the application once: the keys it names were ignored until now.
  • The eight tracon.* metrics that carried tracon.tenant.id carry it only when Tracon:Observability:IncludeTenantTag is true.
  • A tool call, a workflow function node or an agent step does not start once the call-tree budget or the cost quota of the tenant is spent, and a workflow continuation starts from what the runs before it spent.
  • An IToolAuthorizationHandler that denies ToolEffect.External now also closes search_knowledge and search_conversation_memory.
  • /v1/chat/completions refuses a model setting the agent owns, tool-call history and unknown roles with 400.
  • With strict session ownership, an A2A message needs a caller identity to own the conversation.
  • agentReview and toolCallArgsMatch are built-in names; a criterion or check registered in code under either name is refused.
  • An IAgentDecorator with an Order above 0 no longer sees TraconRunOptions.
• Pin every Tracon package to the same exact version. The pre-release Microsoft Agent Framework hosting packages stay pinned at 1.25.0-preview.261014.1, Microsoft.Agents.AI.Hosting.OpenAI at 1.25.0-alpha.261014.1 and A2A.AspNetCore at 1.0.0-preview3. The Model Context Protocol SDK moves to 2.3.0.

Added

• A callable agent can be pinned to a version of the callee: CallableAgentReference.Version. An entry of AgentDefinition.CallableAgents with a version runs that stored version in every call mode (background tasks, one tool for each agent), its child run row records that version, and, for an agent kept in the database, the description the model reads comes from it. An entry with no version runs the callee’s current version, as before. A caller that a workflow step or an approval resumption pins to a version of its own now runs the callee versions that version names: a parent pinned to version 1 no longer calls a child at version 3 unless version 1 says so. A new version of a pinned callee leaves the compiled caller as it is. A name converts to a reference without a version (CallableAgents = ["editor"]), so a list of names stays a list of names. A save, POST /api/agents/validate and the compile refuse a version below 1, a version the callee does not have, a pin on an agent defined in code and a name listed twice: the codes are callable_agent_version_invalid, callable_agent_version_not_found and callable_agent_duplicate, each with the path of the entry. A pin that stopped holding after the save fails the caller by name before its first model call. The agent editor of the console shows a Version of … to run select under each checked agent that has versions and keeps a pin it saved; the version compare shows a change of pin. The OpenAPI document and both generated clients carry the new schema.

• WorkflowAgentStepOptions.AgentVersionParameter lets a run choose the version of an agent step in a graph built in code. Set it to the name of a run parameter declared in WorkflowRegistrationOptions.Parameters. The step reads the value each time it runs: empty or absent runs the agent’s current version, a whole number from 1 runs that version and the step’s run row records it. A value that is not a whole number from 1, a name the workflow does not declare, a version the agent does not have and an agent defined in code fail the step by name before its model call; the error for a value that is not a number never repeats it. It cannot be set together with AgentVersion (GetWorkflowAgentStep throws ArgumentException). A run that continues after an answer reads the value the run started with: a number keeps its version through the wait, an empty value still means the current version when each step runs.

• openai.strictJsonSchema and azure-openai.strictJsonSchema ask OpenAI to enforce the response schema while the model generates. Set either to true in ModelBinding.ProviderSettings (OpenAIProviderNames.StrictJsonSchemaSetting, AzureOpenAIProviderNames.StrictJsonSchemaSetting; SupportedSettings is no longer empty). The request then carries strict: true on the response format of an agent whose ResponseFormat is a JSON schema. It reaches the response format only: the tools of the agent stay non-strict, and a fallback link, which receives no provider settings, is not strict. The setting is off by default. openai reads it on both API surfaces and on every UseOpenAICompatible() registration; a server that does not know strict mode can refuse the request.

• POST /api/agents/validate returns the response schema each provider’s client sends. The report has a new field responseSchemas, one entry per binding and per fallback link (provider, model, strict, schema), for providers that implement the new IResponseSchemaSupport (OpenAI and Azure). Three warnings name what differs from the schema you wrote, each with JSON Pointers into it: response_schema_optional_required (an optional property that does not allow null is sent as required), response_schema_keyword_not_enforced (a bound such as maxLength or pattern is sent as description text) and response_schema_strict_unsupported (strict mode only: the parts OpenAI refuses with HTTP 400, which are oneOf, allOf, if, then, dependentRequired, dependentSchemas and an object without additionalProperties: false). The last one is reported for openai and openai-responses on api.openai.com, the only service measured, and it is a warning so that it never stops a definition from being saved. The OpenAPI document and both generated clients carry the new field and the three codes.

• IResponseSchemaSupport and ResponseSchemaShape. An optional interface of an IModelProvider: given a binding and the author’s schema, it returns the schema the provider’s client sends (EffectiveSchema), whether the request is strict, and the three lists above. A provider that does not implement it adds nothing to the report.

• UseGoogleSpeech registers a Gemini text-to-speech model as the named provider gemini, with GoogleSpeechOptions (Model, Name, MaxCharactersPerRequest, MaxDialogueCharactersPerRequest, DialogueSpeakerMode, Voices, UseAsDefault). One instance speaks one voice (POST /api/voice/speak with "provider": "gemini" answers a WAV file) and voices a dialogue of exactly two voices through GetDialogueSynthesizerAsync. It shares the client of UseGoogle and the provider name google, so one egress rule covers chat, images and speech, and a tenant with its own Google key is served with that key on the client its chat requests use. The speaker format of a dialogue depends on the model generation, and the wrong one answers 400: set DialogueSpeakerMode to PartMetadata (the gemini-3.8 models, the default) or TextLabels (gemini-2.5-flash-preview-tts, gemini-3.1-flash-tts-preview). The audio is a WAV file or raw 16-bit PCM (OutputFormat wav or pcm); a stream is raw PCM. Character timing is refused, and billing is an estimate.

• SpeechProviderDescriptor.Dialogue and GET /api/voice/providers report whether a speech provider can voice a dialogue. The value is the provider’s SpeechDialogueCapabilities (most voices, most characters, whether it reports timing) or null. A caller no longer learns it from the failure of GetDialogueSynthesizerAsync. The OpenAPI document and both generated clients carry the new field.

• SpeechDialogueCapabilities.Check(request, providerName) is the rule a dialogue implementation applies before it calls its service. The built-in ElevenLabs client and the Gemini synthesizer use it, with the same messages; a synthesizer of your own calls it to refuse an empty turn, a turn without a voice, too many voices or too many characters, and never to split or cut the dialogue.

• A front end that speaks the AG-UI protocol can run a Tracon agent. The new package Tracon.AGUI adds MapTraconAGUI() (POST /tracon/agui/{agentName}, after MapTracon()): the body is an AG-UI RunAgentInput, the answer is the AG-UI event stream. It is a Tracon run: recorded, tenant-scoped, role-, key-scope- and session-owner-checked, counted against the quota and priced, with the same protection as MapTracon. The thread is the session, and only the messages after the last assistant message are new input. A tool the front end declares never becomes a tool the model can call: a client-side tool registered with AddClientTool and named in the agent runs on the front end with the schema from the code, a carried client-side tool the request does not declare is 400, and a declared tool the agent does not carry is ignored and recorded on the run (RunEventCustomTypes.AGUIToolsIgnored). A tool that waits for approval, and an MCP server’s request for input, end the run with an interrupt; the answer is the next request’s resume. The approval is audited as approval.decision with "surface": "ag-ui", before it is applied. The first event after RUN_STARTED is a CUSTOM event named tracon.run that carries the Tracon run id. The package takes the AG-UI SDK (AGUI.Server, AGUI.Abstractions) and is not part of the Tracon meta package. See AG-UI front ends.

• A tool can ask the user for information in the middle of a call (MCP elicitation). Tracon now tells every MCP server it connects to that it can answer such a request, with form fields only. In a run started with POST /api/agents/{name}/run (or over the AG-UI endpoint) and a sessionId, the request stops the run as AwaitingInput: the stream sends an inputs event right before done (a response with Idempotency-Key carries inputs in its body), one entry per request with requestId, toolName, serverName, message and requestedSchema. Answer in the next request of the session with AgentRunRequest.InputResponses (ToolInputResponse: RequestId, Action of ToolInputAction Accept, Decline or Cancel, and Content for Accept). The tool call then runs again from its start with the answer, so a server must take the same call twice; the replay asks no second approval. Every other request gets an explicit decline and, inside a run, a tracon.tool.input.declined run event (RunEventCustomTypes.ToolInputDeclined) that names the reason: a run without a session, an OpenAI-compatible call, an A2A task, an MCP tool call, a queued run, an agent called by another agent, a request to open an address (url mode), and a server on the earlier protocol. A tool call stops for input at most once: if the server asks something else the second time, it gets decline, never the old answer. A wrong answer is 400 (unknown or repeated requestId, a field the server did not ask for, a required field left out, a value of the wrong type) or 409 (already answered); another user’s session is 403, as for every run. The values go to the server and nowhere else. The audit entry tool_input.answer names the request, the server, the tool, the action and the names of the fields, never a value, and it is written before the call runs again: it is the eighth fail-closed audit operation (the published set of seven grows by one), so an answer that cannot be recorded is not applied. The playground shows a form made from the requested schema and says which server the answer goes to. RunStatus.AwaitingInput now also appears on the root agent run of a suspended call, and its RunAwaitingInput event carries requestId, toolName and serverName.

• An agent can keep files in a private workspace for each session. Set AgentDefinition.Workspace (WorkspaceSettings: Enabled, ReadOnly, DisableReadApproval; also AgentDefinitionRequest.Workspace, AgentDescriptor.Workspace and workspace in the HTTP body). The agent then lists, reads, searches, writes, edits and deletes files with the eight file_access_* tools of the Microsoft Agent Framework, in an area that belongs to one session of one agent: another session does not see the files, and they are not the agent’s file memory. Tracon runs each tool through the same chain as a tool registered in code: your IToolAuthorizationHandler, argument validation, the tool timeout and the approval step. The tools that change a file (write, replace, replace lines, delete) always ask for approval; DisableReadApproval only reaches the tools that read, and ReadOnly offers the tools that read and nothing else. Tracon:Workspace (TraconWorkspaceOptions) limits a file (256 KiB), the files of a session (5 MiB) and the workspaces of a tenant (500 MiB), and a file also counts 1 KiB for its row; a write past a limit is refused, the model reads “Workspace quota reached”, and the run goes on. The files go with their session: DELETE /api/sessions/{id}, a data subject erasure (its preview, export and delete include them under session_workspace) and the sessions retention target delete them. A run with no session, a workflow run and a replay have no workspace. A host that exposes an agent over A2A or MCP must make its workspace read-only with DisableReadApproval, or the host refuses to open the agent. The console has three boxes for it, and the sample has a workspace-drafter agent. A tool of your own cannot take the name of one of the eight file tools, an agent that has a workspace cannot have a / in its name, and an agent with file memory cannot be named ~workspace…. The automatic continuation of an interrupted run refuses an agent that has a workspace. The default file store is in memory and loses the files at a restart: use a SQL provider. SQL Server counts the UTF-16 bytes it stores, so a limit there holds half as many ASCII characters. Migration 0064 (PostgreSQL), 0052 (SQL Server) and 0051 (SQLite) add an index on agent_files (tenant_id, path); the queries behind the limits and the deletion would otherwise read the whole table.

• An agent remembers what its user said in earlier sessions. Set MemorySettings.EnableConversationMemory on a definition, call UseConversationMemory(options => options.VectorDimensions = …) once, and register a Microsoft.Extensions.VectorData.VectorStore. The agent then finds what the same user told it in an earlier session and gets it as context, before each turn (ConversationMemorySearch.BeforeEachTurn, the default) or through a search_conversation_memory tool the model calls (OnDemand). A record carries the tenant, the agent, the user and the session; a search looks at tenant, agent and user, so a user is remembered across sessions and never seen by another user, agent or tenant. A run with no user or no session neither reads nor writes. Only user and assistant text is stored, not tool results. The records go with their session: DELETE /api/sessions/{id}, a data subject erasure (its preview, export and delete include them under conversation_memory) and the sessions retention target delete them first. The store embeds the text, so that model call is not on the run’s usage. The console has one box and one choice for it. Check the connector first: the Microsoft.SemanticKernel.Connectors.* packages (1.74 preview) call a member that Microsoft.Extensions.VectorData.Abstractions 10.7 removed, and fail at search time without a build warning; CommunityToolkit.VectorData.* 1.0 works. A workflow run, and the agent steps below it, remember nothing: the workflow’s session id never gets a session record, so nothing could delete what they kept. The records hold the message text in plain text, in your store, outside content protection.

• A definition can turn the approval of the two skill read tools off. Microsoft Agent Framework asks for approval before load_skill, read_skill_resource and run_skill_script, so an agent with skills could not run where nobody can answer: an A2A or MCP call, a run with no session, a scheduled run. The new SkillSettings record (AgentDefinition.Skills, AgentDefinitionRequest.Skills, AgentDescriptor.Skills, and skills in the HTTP body) has one member, DisableReadApproval. With true, load_skill and read_skill_resource run without approval. run_skill_script keeps its approval: it runs code, so no member of the definition turns that off (a standing approval rule can still approve it). The default is unchanged, a definition stored before this release reads back with all three tools asking, and the console’s skills section has one box for it. A definition that sets Skills but names no skill gets the validation warning skill_settings_without_skills. Skill text reaches the model as instructions, so turn the box on only for skills that a tenant administrator writes.

• A workflow waits for a tool that needs approval, and a person answers it. Before, an agent step whose tool needs approval failed the whole workflow unless an auto-approval rule existed. Where a Microsoft Agent Framework pattern hosts the agent (a stored Sequential, Concurrent, Handoff, GroupChat or Magentic workflow defined with agentNames, and a code graph that binds the agent with GetWorkflowAgent), the workflow now stops: the step’s run closes AwaitingApproval, the workflow run closes AwaitingInput, and the request has the new form WorkflowRequestForm.ToolApproval, whose prompt names the tool and adds what your IToolApprovalPresenter says about the call (the arguments are not copied). Answer it with POST /api/workflows/runs/{runId}/respond: approved, an optional reason in text that the agent reads, and remember (new on WorkflowRespondRequest) to save a rule for that agent and tool. The answer carries a decision only: the tool call comes from the request the workflow recorded, so a data value is refused with 400, and so is remember with approved: false or on any other form. The decision is written to the audit trail as approval.decision before the workflow continues; an entry that cannot be written refuses the answer. The tool runs once, in the new run the answer opens, in whichever process takes the answer. A request nobody answers closes the step that waited with the workflow when its time limit passes. The console’s workflow card asks for the decision, a reason and the rule. An agent node of a Sequential node list and a step bound with GetWorkflowAgentStep run the agent in a plain function node that cannot wait, so a tool that needs approval still fails the run there, and so does a tool of the Magentic manager; an agent that a step’s agent calls as a sub-agent still cannot ask. A tool approval is answered once, whatever the workflow’s response mode: the same decision again follows the run the first one started, and a different one is 409.

• An A2A conversation keeps its history, and it belongs to the caller that started it. A message that carries a contextId now continues a conversation: Tracon stores the session and the agent sees the earlier turns. Before, the reply carried the contextId back but the agent saw one message, so a caller believed it was in a conversation that did not exist. A conversation is stored under the tenant, the agent, the caller and the contextId, and a caller that sends the contextId of another caller starts a new conversation. The caller is the signed-in user (Tracon:Audit:ActorClaimType applies), the API key, the static AuthToken, or, with no identity at all, the local operator; all callers without an identity share one conversation space, and a signed-in user whose identity cannot be read is refused. The session identity is a2a: followed by a SHA-256 digest of the four parts, so a contextId of any length fits the session identity column. Each turn re-sends the history to the model, so the tokens per message grow with the conversation. UseA2A() registers the store for each exposed agent and an AgentIsolationKeyProvider; a store or a provider the application registers itself wins. A message without a contextId is still a single turn, but Tracon stores a session for it too (it makes up a contextId and the reply carries it), and session retention is off by default; set a maximum age for the sessions target to bound the table. The change adds no migration.

• An eval case lists the tool calls it expects, with their arguments, and toolCallArgsMatch checks them. EvalCase.ExpectedToolCalls is a list of EvalExpectedToolCall: a tool Name and optional Arguments. The new check kind toolCallArgsMatch passes a case when, for every entry, the agent called a tool of that name and one such call carried every listed argument. The listed arguments are a subset (the call may carry others) and a value compares by its JSON meaning: 2 equals 2.0, an object equals one with the same members in any order, and a null value means “absent or null”. Microsoft Agent Framework’s own ToolCallArgsMatch compares a number by its .NET type and an object by its text, so an expected 2 never matched; Tracon’s check does not use it. The reason of a failed case names each entry (not called, args mismatch) and never repeats an argument value. A custom evaluator receives the same calls on EvalItem.ExpectedToolCalls, as Microsoft Agent Framework reads them. The console’s case editor takes a tool name and a JSON object of arguments for each call and refuses an argument text that is not a JSON object. Promoting a reference run writes the names of the tools the run called, without arguments. The change adds eval_cases.expected_tool_calls (migration 0063 PostgreSQL, 0051 SQL Server, 0050 SQLite). A cell of that column that SQL Server or SQLite holds as text and that is no longer the array Tracon writes reads as an entry no run can call, so the case fails instead of passing with nothing to check, and the listing still works. A custom IEvalStore meets this in Tracon.Testing.Contracts.Xunit: EvalStoreContract adds EvalStoreContract.ReplaceCasesAsync_round_trips_an_expected_argument_of_every_json_kind, EvalStoreContract.ReplaceCasesAsync_reads_back_an_empty_list_for_a_case_that_expects_no_tool_call and EvalStoreContract.A_row_written_before_expected_tool_calls_existed_reads_back_its_names, and renames ReplaceCasesAsync_stores_expected_tools_and_context to EvalStoreContract.ReplaceCasesAsync_stores_expected_tool_calls_and_context. The last one needs three hooks a store on SQL overrides (SupportsRawSql, ExecuteRawAsync, QualifiedEvalCasesTable, and FormatIdForRawSql when it spells an id otherwise); a store without SQL skips it.

• A host registers a tool the model provider runs, and a definition selects it by name. AddHostedTool(name, kind, factory) registers a web search, a code interpreter or a file search (HostedToolKind); the factory receives a HostedToolContext with the tenant, the provider of the agent’s model and the services, and builds the Microsoft.Extensions.AI tool for that tenant. A definition lists the name in ToolNames, the same list as a function tool. The provider runs the tool inside the model call, so no approval, permission or timeout applies. A provider states which kinds its API surface runs through the new IHostedToolSupport (HostedToolKinds); a definition that selects a kind the provider would drop, on the primary model or on a fallback, is refused when the agent is built and by POST /api/agents/validate (hosted_tool_unsupported, with the path of the tool name), instead of running without the tool. Measured against the request each adapter writes: openai-responses runs all three kinds, anthropic and google run the web search and the code interpreter, openai (Chat Completions) and azure-openai run none. An agent selects at most one hosted tool of each kind; the cached compiled agent follows what the factory builds, so a tenant that replaces its vector store reaches the next run. GET /api/tools lists hosted tools with ToolDescriptor.HostedKind, the console shows a badge, and the sample has hosted-openai, hosted-claude and hosted-gemini.

• A hosted tool call is priced. Tracon:Pricing:HostedTools:{provider}:{kind}:PerCall sets the price of one call. The amount joins the run’s non-token cost, so the budget, the quota and the run.completed webhook count it once, and a budget the call used up stops the next model turn. A kind with no price is listed on the run and not added to its cost (the run’s UnsummedItemCount); it is never priced at zero, and the host logs one warning. The code interpreter is billed by container and its price per call is an estimate. When Anthropic bills more searches than the response shows, the difference is added. The harness’s own web search is priced the same way; before, no hosted call had a cost. ToolUsageUnits.Calls names the unit.

• An agent calls a callable agent with one tool call. SubAgentSettings.CallMode (SubAgentCallMode.Background, the default, or Tool) picks what the model sees. With Tool, each agent in CallableAgentNames is one tool named after the agent (each run of characters other than letters and digits becomes one underscore), instead of Microsoft Agent Framework’s background task tools. The sample router agent asked one question took 5 model calls and about 3,600 input tokens with background tasks, and 2 model calls and about 410 input tokens with Tool (real OpenAI gpt-5.4-mini, three runs each); for work that runs in parallel, background tasks stay the better choice. The depth limit, the budget of the tree, the tenant check, the wait limits and the refusal of a sub-agent that needs tool approval apply in both modes. A callable agent whose tool name another tool of the agent already has (ToolNames, a skill tool, search_knowledge, another callable agent) is refused by validation and save (sub_agent_tool_name_conflict, 400) and by the compiler. The agent editor has a control for the mode and the version compare shows it. A sub-agent that fails because its model provider is down, or because it no longer exists, answers the parent with the reason as the tool result, as a background task does. A row saved before this setting reads as background tasks.

• A definition sets the model’s request fields and the tool-call loop. ModelBinding gains Seed, TopK, StopSequences, FrequencyPenalty, PresencePenalty, ToolMode (auto, none, required or required:<tool>), AllowMultipleToolCalls and ReasoningOutput (None, Summary or Full), and ToolLoop (ToolLoopSettings: AllowConcurrentToolCalls, MaximumConsecutiveErrors, TerminateOnUnknownCalls). They are part of the definition, so a version, an experiment variant and a replay carry them; before, only an agent extension could set most of them and Reasoning.Output could not be set at all. A provider states which of the fields its API surface sends through the new ISamplingSupport (SamplingFields). A definition that sets a field the provider would drop, on the primary model or on a fallback, is refused when the agent is built and by POST /api/agents/validate (sampling_field_unsupported, with the path of the field), instead of running without it. The shipped providers state what the model adapters send; the table is in Model providers. Tracon.Testing’s FakeModelProvider accepts every field, and the agent editor has controls for all of them.

• Model content and workflow events Tracon has no type for are recorded, not dropped. A hosted tool call or result (web search, code interpreter, image generation, hosted MCP), a provider ErrorContent, generated or attached data, a file reference, and any content type Tracon does not know yet are written as a Custom run event of type tracon.content (RunEventCustomTypes.Content). A WorkflowEvent that the workflow stream does not map, such as an event of your own that an executor of a code workflow raises, is written as tracon.workflow.event (RunEventCustomTypes.WorkflowEvent); its warning in the log is now a debug entry. The payload holds no data bytes, no URI, no tool inputs or outputs; its free text is the provider’s error message and the text of a string workflow payload, cut at 2 048 characters, and any other workflow payload is named by its type only. Both payloads follow RecordToolPayloads. Unlike the quota and truncation notices, tracon.content is not sent on the live POST /api/agents/{name}/run stream; a workflow run’s stream sends tracon.workflow.event like every recorded event. Plain text with RecordMessageDeltas off, reasoning with RecordReasoningDeltas off, usage and approval content stay as they were. Read the events from GET /api/runs/{id}/events.

• A named agent extension reaches Microsoft Agent Framework options on a compiled agent. AddAgentExtension(name, configure), AddAgentExtension<T>(), and an instance overload register code that sets a framework option, adds an AIContextProvider, or wraps the agent with context.Use. A definition selects it with the new ExtensionNames list, in call order, and the agent editor offers the registered names (GET /api/agent-extensions). The agent still goes through the definition compiler, so it keeps the model rings, the tenant’s own provider key, the egress policy, and cost. The compiler refuses a change to an option the definition or a tenant and security decision owns, and names the extension and the option. AgentDefinition, AgentDescriptor, and AgentDefinitionRequest gain ExtensionNames. A provider an extension adds can add tools, and those skip the tool chain; a replay that plays tools back does not run extensions.

• Any Microsoft.Extensions.AI speech client serves a named Tracon speech provider. AddSpeechSynthesizer(name, TextToSpeechClientBinding) and AddSpeechTranscriber(name, SpeechToTextClientBinding) take the client from the container, by service key or unkeyed. Every call passes the tenant’s egress policy against the binding’s provider name; a tenant with its own key for that provider is refused; the host stops at startup when the client is missing or has no provider name. The binding declares the character limit and the voice list, which the client cannot report. Billing is an estimate, character timing and dialogue are refused. No public member names a Microsoft.Extensions.AI speech type.

• UseOpenAISpeech registers OpenAI text-to-speech and speech-to-text as the named providers openai, with OpenAISpeechOptions (SynthesisModel, TranscriptionModel, names, MaxCharactersPerRequest, Voices, UseAsDefault). Each name is bound to one model. The clients run on the shared OpenAI client’s pipeline and not on AudioClient, so a host publishes with Native AOT.

• A factory agent built outside the model registry logs one warning. When the chat client of an AddAgent(name, factory) agent did not come from IModelProviderRegistry, the catalog writes a warning the first time it resolves that agent name, because its model calls skip the model rings. An agent that exposes no chat client gets no warning, and a resolve never fails because of the check. The guide “Use any Microsoft Agent Framework feature” compares the decorator, the factory agent, and the custom agent source by what each keeps, and samples/Tracon.Samples.MafFeatures builds all three.

• TraconErrorTypes lists the error codes of runs, jobs and OpenAI-compatible errors. One class holds them in one place: the type of a failed run (tool_timeout, content_blocked, run_budget_exceeded, …), the codes of a job the queue failed (tracon.job.attempts-exhausted, …) and the error.type of the OpenAI-compatible endpoints (model_not_found, …). The *ErrorType constants of the exception classes (TraconToolTimeoutException.ToolTimeoutErrorType and the others) and JobErrorCodes stay, and they carry the same values; no value changed, so no stored run record and no client that matches a code is affected. The codes of the findings that POST /api/agents/validate returns (unknown_tool, cycle, …) are listed the same way and are not public members. A code never changes inside a major version.

• The release check compares HTTP, SSE, telemetry, configuration keys, error codes and the CLI with the last published version. Until now only the .NET API had a check against the last release. From 1.0.0-rc.1 a removed or renamed endpoint, response field, event name, instrument, attribute, configuration key, error code, CLI command or option stops the release, and so does a change that the rules do not name. A patch release does not add to any of them. See What 1.x promises for HTTP, telemetry, configuration, error codes and the CLI.

• One tenant can no longer take every workflow slot of a process, or the front of the job queue. The new Tracon:Workflows:MaxConcurrentRunsPerTenant (TraconWorkflowOptions.MaxConcurrentRunsPerTenant, off by default, from 1 to MaxConcurrentRuns) limits how many workflow runs one tenant has going at the same time, in two places. In a process, a run beyond the tenant’s limit waits for a tenant slot before it takes a shared slot, so it holds nothing while it waits and never delays another tenant. In the job queue, a worker does not lease a queued workflow job (tracon.workflow, tracon.workflow-run) of a tenant that already holds that many leased, and leases the oldest job of another tenant instead; this count covers every process that shares the store, and it is read, not locked, so workers that lease at the same moment can take a tenant past the limit by up to their own number. The wait for a tenant slot counts toward RunTimeout, as the wait for a shared slot does. The setting is checked at startup, and a value that is not a number stops the host. See workflow concurrency.

• Another agent can be the stop criterion of a loop: agentReview. A LoopCriterion with Kind = "agentReview" names a reviewer agent of the catalog in the new ReviewerAgent, and optionally a version in the new ReviewerAgentVersion. After each iteration the reviewer reads the request, the iteration number and the draft (the last assistant message), and answers with {"approved": true|false, "feedback": "..."}: true stops the loop, false sends the feedback to the agent as the next input. The reviewer runs as a child run of the run under review, through the same door every sub-agent call uses, so the tenant check, the depth limit, the run and token budget, the quota, the wait limit and the refusal of a tool that waits for approval all apply. A refused call, a failed call and an answer that is not that object are failures of the criterion, and OnCriterionError decides what follows; an answer that cannot be read is never an approval. The shape is the reviewer agent’s own response format, not an option the loop sets on the call. Validation reports loop_reviewer_missing, loop_reviewer_self, loop_reviewer_version_invalid and loop_reviewer_not_found, and warns with loop_reviewer_verdict_unknown when the reviewer has no JSON schema with a boolean approved and a string feedback. The console’s Loop panel lists the agents and takes the version. GET /api/loop-criteria lists the kind. See Another agent as the reviewer.

• The LoopIterationCompleted event says who decided. Its payload has a new criteria list: every criterion evaluated in that iteration, in order, with its kind and decision (stop, continue or failed). An aiJudge entry names the judge (provider and model of the call, the fallback model when the judge’s own model failed over), and an agentReview entry names the reviewer (agentName, agentVersion and the runId of its child run). The event text names the reviewer too. The judge’s reasoning, the reviewer’s answer, the draft and the feedback are not written. The loop.iteration-completed frame of the native stream carries the same data. A reader that ignores a field it does not know needs no change.

• The run stream of an agent with a loop says where each iteration ends. POST /api/agents/{name}/run already streamed every iteration, but nothing in the update frames marked the border, so a client that read the stream could take the first draft for the answer. After each iteration the loop evaluated, the stream now sends a loop.iteration-completed frame, between the last update of that iteration and the first of the next. Its data is the recorded LoopIterationCompleted event, byte for byte what GET /api/runs/{id}/events serves. The answer is the iteration the last frame closes when it has continued: false; when it has ceilingReached: true, the answer is the iteration after it, because the turn at the ceiling is not evaluated. The update after a frame with continued: true is the loop’s feedback to the model (role user), not the model’s text. The event’s payload is null when RecordToolPayloads is off. An agent without a loop, an event the store could not record and a sub-agent’s loop send no frame. Recorded event timestamps now have whole microseconds, so the frame and /events agree on every store. The console playground draws a divider at each frame. A client that ignores a frame name it does not know needs no change. See Streaming.

Changed

• AgentDefinition.CallableAgentNames is now CallableAgents, a list of CallableAgentReference (breaking). Rename the initializer; a name converts to a reference, so CallableAgentNames = ["support"] becomes CallableAgents = ["support"]. AgentDefinitionRequest.CallableAgentNames is CallableAgents too, and over HTTP the field is callableAgents, a list of { "name": ..., "version": ... } objects. A request body that still carries callableAgentNames is refused with 400 and names the new field, so it cannot drop the callable agents in silence. The validation path of a tool name that another tool already has moved from callableAgentNames[i] to callableAgents[i].name. AgentDescriptor.CallableAgentNames (the catalog’s list of names) is unchanged. Upgrade note: no migration. A stored definition that holds the old key reads back as entries with no version, and takes the new shape the next time it is saved; a custom IAgentDefinitionStore must keep the version of each entry (AgentDefinitionStoreContract now checks it).

• IAgentDefinitionStore never gives a version number twice for one name. SaveAsync returns one more than the highest version the name ever had, including the versions of a definition that was deleted; DeleteAsync still removes the definition and every one of its versions and keeps only the number. A custom IAgentDefinitionStore must keep that number too: AgentDefinitionStoreContract has eight more cases that a store which restarts at 1 now fails: AgentDefinitionStoreContract.SaveAsync_after_DeleteAsync_continues_the_numbering, AgentDefinitionStoreContract.The_numbering_survives_every_delete_not_only_the_first, AgentDefinitionStoreContract.DeleteAsync_of_a_name_that_never_existed_does_not_start_a_numbering, AgentDefinitionStoreContract.RollbackAsync_after_a_recreate_continues_the_numbering, AgentDefinitionStoreContract.RollbackAsync_for_a_deleted_agent_throws_and_keeps_the_numbering, AgentDefinitionStoreContract.One_tenants_delete_does_not_move_another_tenants_numbering, AgentDefinitionStoreContract.Concurrent_first_saves_of_a_new_name_get_distinct_versions and AgentDefinitionStoreContract.Concurrent_saves_of_one_name_get_distinct_versions_across_a_delete. The PostgreSQL, SQL Server and SQLite migrations add the agent_definition_version_counters table (0065, 0053 and 0052), one row of name and number per agent and no agent content, and start each existing agent’s counter at the version it holds today. Upgrade note: an agent that was deleted and created again before the upgrade cannot be recovered; its earlier numbers were never kept, so its counter starts at the highest number it holds now. During a rolling upgrade an older process may still save an agent without touching the counter: the next number is one more than the larger of the counter and the agent’s own version, so such a save never collides with the history it wrote.

• A configuration value that cannot be read stops the host at startup. A key that held text its type could not read (Tracon:Tools:DefaultMaxOutputBytes = "10MB", Tracon:RunRecording:RecordToolPayloads = "nope", Tracon:RateLimit:Enabled = "yes") was skipped and the shipped default stayed, with no message. 25 of those defaults are the loose side, so a typo left a limit open or a protection off. Now every number, flag, time span and enum name in the Tracon:* sections and in the package sections (Mcp, Voice, Voice:Live, Voice:Conversation, the providers, the SQL stores) must be readable, and so must the numbers of a model catalog entry and of a price. The host refuses to start and the message names the full key and quotes the text: Tracon:Tools:DefaultMaxOutputBytes is '10MB', which is not a 32-bit whole number. Every unreadable key of the same options type is listed in one message. Empty text, or only white space, is still “not given” and keeps the default. Code that assigns the option after binding still wins, so a typo you have overridden in a Configure callback does not stop the host. Upgrade check: start the application once; the keys it names are the ones that were ignored until now.

• A list key that holds one value is refused. Tracon:Skills:Scripts:EnvironmentAllowList=PATH was ignored and the default list stayed. The message now says to write …:EnvironmentAllowList:0. A JSON [] and a key with no text keep the default list, as before; to empty a list, clear it in code. This covers every list key (Lanes, HttpSchedulableHandlerKeys, DeniedTerms, AgentNames, AllowedMediaTypes, ThresholdPercents, RetryDelays, Columns).

• An entry of a list or a map that cannot be read is left out and named by its position or name (Quotas:ThresholdPercents:1, Scheduling:MaxConcurrentJobsPerLane:media). It used to be bound as 0 (or as an undefined value) so that the options validator would complain about the stand-in; the message now quotes what you wrote.

• A decimal no longer takes a thousands separator. Tracon:Pricing:…:Input = "1,5" was read as fifteen. It is now an unreadable value; write 1.5.

• Tracon:Voice:Live:DelegationMode is refused by the same rule instead of throwing while the options are bound: the host stops at startup with an OptionsValidationException that names the key and the one mode, Client.

• An address key that is not an absolute address is refused by the same rule. Tracon:Voice:Endpoint, Tracon:Providers:OpenAI:Live:Endpoint and Tracon:Mcp:OAuthCallbackBaseUri ignored text such as gateway.example.com/v1 and kept the default, so speech and live sessions went to the provider’s public address. The host now stops and names the key: … is 'gateway.example.com/v1', which is not an absolute address such as https://example.com/.

• A map key that holds one value is refused. Tracon:Scheduling:MaxConcurrentJobsPerLane=5, …:MaxDurationByHandlerKey=00:10:00 and …:LaneByHandlerKey=media name no lane or handler and were ignored. The message now says to write …:MaxConcurrentJobsPerLane:<name>.

• The knowledge search and the on-demand conversation memory search run through the tool chain. search_knowledge (MemorySettings.EnableVectorSearch) and search_conversation_memory (ConversationMemorySearch.OnDemand) were added to a run as bare functions, so your IToolAuthorizationHandler, your IToolArgumentsValidator, the tool timeout and output limit, and the tree budget never saw them, and the refusal of a tenant’s egress policy reached the model as “Error: Function failed.” Now both pass the chain a tool registered in code passes. An authorization handler that denies ToolEffect.External calls now also closes both searches: it is asked with the tool name and Effect = External, because the text of the query leaves the process, and the model reads your reason as the result. A validator that rejects a tool it does not know rejects them too. Neither tool is in IToolRegistry, so GET /api/tools does not list them; write their names in your policy as fixed text. A spent budget stops the search before the query is embedded; the whole call, the embedding included, ends at Tracon:Tools:DefaultTimeout (30 seconds by default); and a hit reaches the model as text, trimmed at Tracon:Tools:DefaultMaxOutputBytes like any tool result. The call line of search_knowledge in GET /api/runs/{id}/tools now has a usage: unit tokens, the input token count of the embedded query as the provider reported it, and no cost, so it adds to no budget, quota or webhook total; the run’s nonTokenCost counts it under unsummedItemCount. An embedding has no price in Tracon yet. See Embedding Tracon.

• A tool call does not start once the call tree’s budget is spent. The budget (Tracon:AgentGraph:MaxTotalTokens, MaxTotalCost, MaxDuration) already refused the next model call, a new agent step and a workflow function node. A tool call was the one start it did not read, so when one model turn asked for two paid tools and the first passed the ceiling, the second still ran: its money and its side effect were gone, and the model call that would have read its result was refused. Now the second tool does not run. Its result is the limit, the setting to raise and “The tool call did not start.”; a streaming run (the HTTP run is one) records the call as failed; and the run ends at its next model call as before (Failed, run_budget_exceeded). All three limits stop a tool call, MaxTotalTokens included, since a model reads its result; a function node is still stopped by cost and time only. The check covers tools registered in code, session workspace tools, MCP tools, the knowledge and conversation memory searches and skill scripts, and it runs before your IToolAuthorizationHandler. A tool that has started is never stopped, so the call that crosses the ceiling is the last one that starts; with ToolLoop.AllowConcurrentToolCalls on, the tools of one turn start together and all of them start. A hosted tool runs inside the model call and is not checked. A host that sets no ceiling still has the default MaxTotalTokens of 200,000: a tool that a turn asks for after the tree has passed it no longer runs. See Bound multi-agent trees.

• agentReview is now a built-in loop criterion kind, so a criterion registered in code under that name is refused. AddLoopEvaluator("agentReview", ...) (in any casing) throws TraconException at startup, the way the other four built-in names do. A definition that named such a kind now means the built-in one; rename your criterion before you update.

• A workflow run that waits for a concurrency slot is Queued, not Running. The run’s record still opens before the wait, but it reads Queued while the run waits for a slot of MaxConcurrentRuns or of MaxConcurrentRunsPerTenant, and Running once it has them. A run that finds a slot free opens Running as before. GET /api/runs, the run’s detail and the console show it (the queued badge was already there). A dashboard that counted Running rows as “using a slot” now counts only the runs that have one. POST /api/runs/{id}/cancel reaches a waiting run (202, closed Canceled); until now it sent every Queued run to the job queue.

• A Queued run row can be closed by run reconciliation. IRunStore.TouchHeartbeatAsync now marks Queued rows as well as Running ones, and IRunStore.ClaimOrphanedRunsAsync closes a Queued row whose heartbeat is older than the threshold as Failed (orphaned). A process writes a heartbeat for the runs it executes, and for a workflow run that waits in it for a slot, so a Queued row with a heartbeat is a run whose process is gone. A Queued row that never sent one is still the job queue’s and is never closed by reconciliation. An IRunStore you implement must do the same: the shared contract tests (RunStoreContract) have three new cases, RunStoreContract.ClaimOrphanedRunsAsync_closes_a_Queued_row_whose_heartbeat_is_stale, RunStoreContract.ClaimOrphanedRunsAsync_does_not_touch_a_Queued_row_with_a_fresh_heartbeat and RunStoreContract.A_run_promoted_from_Queued_to_Running_keeps_the_heartbeat_it_sent_while_it_waited, and ClaimOrphanedRunsAsync_never_touches_a_Queued_row is now RunStoreContract.ClaimOrphanedRunsAsync_never_touches_a_Queued_row_that_has_no_heartbeat.

• Breaking for implementers (preview): IJobStore.LeaseAsync(owner, leaseDuration, lanes, cancellationToken) is now IJobStore.LeaseAsync(JobLeaseRequest request, cancellationToken). JobLeaseRequest carries Owner, LeaseDuration, Lanes and the new TenantCap (JobTenantCap: the handler keys and MaxLeasedPerTenant); a new option is a new property, not a new parameter. An IJobStore you implement takes the request and, when TenantCap is set, skips a ready job of a handler key in the cap while its tenant holds that many live leases on those keys (an expired lease does not count). A caller reads request.Lanes where it read lanes. JobStoreContract has eleven new cases for the cap: JobStoreContract.Lease_without_a_tenant_cap_gives_one_tenant_the_whole_queue_in_age_order, JobStoreContract.Lease_with_a_tenant_cap_leases_up_to_the_cap_for_one_tenant, JobStoreContract.Lease_with_a_tenant_cap_skips_a_tenant_at_the_cap_and_leases_the_oldest_job_of_another, JobStoreContract.Lease_with_a_tenant_cap_counts_a_running_job, JobStoreContract.Lease_with_a_tenant_cap_counts_both_workflow_handler_keys_together, JobStoreContract.Lease_with_a_tenant_cap_does_not_count_a_job_of_another_handler_key, JobStoreContract.Lease_with_a_tenant_cap_does_not_count_a_lease_that_has_expired, JobStoreContract.Lease_with_a_tenant_cap_does_not_count_the_leases_of_another_tenant, JobStoreContract.Lease_with_a_tenant_cap_still_honors_the_lane_filter, JobStoreContract.Lease_with_a_tenant_cap_still_leases_a_job_of_another_handler_key_of_a_tenant_at_the_cap and JobStoreContract.Lease_with_a_tenant_cap_that_names_no_handler_key_or_no_room_is_refused.

• tracon.tenant.id is no longer on metrics by default. The metrics tracon.runs, tracon.run.cost, tracon.judge.cost, tracon.judge.score, tracon.model.cache, tracon.audit.write_failures, tracon.run.recording_failures and tracon.job.executions carried the tenant on every series, which multiplies each series by the number of tenants. They now carry it only when Tracon:Observability:IncludeTenantTag (TraconObservabilityOptions.IncludeTenantTag) is true; it is false by default. Spans and the quota gauges (tracon.quota.usage, tracon.quota.limit) carry tracon.tenant.id as before. A dashboard or an alert rule that filters or groups one of the eight metrics by tracon.tenant.id shows no series until you set the key. A value that is not true or false stops the application at startup. See the tenant tag on metrics.

• A workflow run that continues an earlier run no longer starts with a budget of zero. A person’s answer to a request, an operator’s resume (POST /api/workflows/runs/{runId}/resume) and a recovery after an interruption each start a new run row, and each used to build a new call-tree budget: a workflow with an approval loop got the whole Tracon:AgentGraph ceiling again with every answer, and a run that failed for its budget was resumed into the node that had been refused. The ceiling is now the logical run’s. The new run starts from what the runs before it spent (tokens, cost and child runs), and the time limit counts the time the chain’s runs were executing, not the time the workflow waited for a person. A workflow that stayed under its ceiling only because every answer got a new one now fails at the node that crosses it, with run_budget_exceeded: raise MaxTotalCost, MaxTotalTokens, MaxTotalRuns or MaxDuration to the size of the whole review, not of one round. A chain that cannot be read (the run store does not answer, or it is longer than 128 runs) ends the run Failed before its first node. A run that an interruption closed holds what its function nodes reported only in its items, and Tracon reads them from there. A nested sub-agent call is spent but not counted as a started run. See the ceiling of a workflow.

• An operator’s resume of a workflow run records the run it resumes in continuedFromRunId. Until now only a recovery wrote the link, so the resume run looked unrelated to its source and GET /api/runs?continuedFromRunId= did not list it. A run that answers a person’s request still does not carry it; the answer names the run that waited in its own history. A continuation that a recovery opened keeps the link the recovery wrote. The resume run joins the chain the recovery and the response gate read, so a repeated answer follows it, and a resume of a run whose queued job may still recover it is recovered with that job: resume a run only after its job has ended.

• A workflow function node or an agent step is refused once the tenant’s cost quota is spent. The quota was read at the door only (429), so a workflow that waited for a person, or ran for hours, passed a quota that was spent in its first minutes. Before a function node or an agent step starts, the tree asks the tenant’s quota: the cost limit stops a function node, and the token and cost limits stop an agent step or one agent’s call to another. The run ends Failed with the new error type tenant_quota_exceeded (TraconTenantQuotaExceededException, class QuotaExceeded); when one agent calls another, the refusal comes back to the model as a tool result, as a spent call-tree budget does. Only a start is refused, and the check counts what the run has spent that its counter has not seen yet, so the nodes it already finished count. The run limit stays at the door. A node registered with options.StartsWhenBudgetIsSpent = true is exempt from the quota as it is from the budget, and a refusal is never retried by a node’s retry policy. The check reads the tenant’s rules (one read; two when the tenant has a rule) each time a node or step starts, and follows Quotas:AllowOnStoreFailure when the store cannot be read. With Quotas:Enabled = false nothing is read. Quotas are on by default, so a model call is priced in every installation that has not turned them off: AgentRunBudget.ConsumedCost now holds the cost of the model calls even when AgentGraph.MaxTotalCost is not set. The price lookup costs about 1 microsecond per model call (24 models in the catalog). See A quota also stops work that has not started.

• A data subject erasure deletes the copies of a session outside the SQL rows before it opens its transaction. The copies are the records of conversation memory in your vector store and the files of a session workspace. They used to go after the rows were deleted and before the commit. The files live in the same database, and SQLite lets one connection write at a time: a delete on a second connection, while the erasure held its writes, waited for the busy timeout and failed. A copy that cannot be deleted still fails the call with every row in place, and repeating the call finishes the work. If a later step fails after the copies are gone, the repeat call deletes the rest and its audit entry counts only what was left. The sessions retention target now always reads the expired batch and deletes the files of each session before the rows (an installation with no workspace deletes nothing extra, and the delete is answered from the new index).

• Model Context Protocol SDK 2.3.0 (ModelContextProtocol.Core, .AspNetCore, .Extensions.Tasks). No public member was removed. A published agent’s tools/call from a client on the 2026-07-28 revision now gets its response headers with the result: a proxy with a time-to-first-byte limit cuts a long call. Use EnableTasks for long calls, or raise that limit.

• An A2A message is refused before the model is called when session ownership is strict and the caller has no identity to own the conversation. With Tracon:SessionOwnership:Enabled and RequireAuthenticatedOwner on, a conversation needs an owner. A2A wrote no session until now, so the rule never reached it. The caller receives a JSON-RPC internal error (-32603) and the cause is in the server log at Error level. A message that resumes a conversation another user owns is refused the same way, which matters when one API key speaks for several users. Bind IRunAttributionContext to the identity pipeline, or turn RequireAuthenticatedOwner off, before you upgrade an installation that publishes an agent over A2A.

• EvalCase.ExpectedTools and EvalCaseDraft.ExpectedTools are replaced by ExpectedToolCalls. This breaks source and the JSON of a case. The old field held tool names and no check read it, so a case that filled it asserted nothing; a name-only entry of the new field is checked. PUT /api/evals/{name}/cases answers 400 (Removed field) to a body that still carries expectedTools and names expectedToolCalls; the expectedTools of the case list is gone. A case stored by an earlier build keeps its names: they read back as entries without arguments, the old column stays in the table and is never written, and the next save of the case writes the new column. A custom check can no longer be registered under the name toolCallArgsMatch; it is a built-in kind now.

• A call of a registered hosted tool is a pair of tool events, not a tracon.content event. The calls of a tool added with AddHostedTool are ToolInvoking and ToolInvoked events under the registered name, with the provider’s call identifier and no payload, and a tool invocation record that carries the call’s measurement (unit calls, quantity 1). A hosted call that no registered tool owns, such as the harness’s web search, stays a tracon.content event as before. A streamed call that the provider shows in several pieces is written once. A replay that plays tools back (ReplayTools) or runs none (NoTools) removes a hosted tool, so it does not search and bill again.

• ModelBinding.AllowConcurrentToolCalls moved to ModelBinding.ToolLoop.AllowConcurrentToolCalls. This breaks source and the JSON of a definition. A definition stored by an earlier build is read with the old key moved, so no migration runs and the setting is kept; the next save writes the new place only, and so does a rollback. POST /api/agents, PUT /api/agents/{name} and POST /api/agents/validate refuse the old key with 400 (Removed field) and name the new path. A fallback link now takes the whole ToolLoop of the primary model.

• An agent extension and the options of one run can no longer set Seed, TopK, StopSequences, FrequencyPenalty, PresencePenalty, ToolMode or AllowMultipleToolCalls. The definition owns them now; an extension that changes one fails the compilation and names the option, and ChatClientAgentRunOptions that sets one throws ArgumentException. One exception: a run may set AllowMultipleToolCalls to false, which a handoff step does to hand off to one agent.

• /v1/chat/completions refuses a model setting the agent owns with 400. temperature, top_p, max_tokens, max_completion_tokens, frequency_penalty, presence_penalty, seed, stop, logit_bias, reasoning_effort, response_format, tools, tool_choice, functions, function_call, n, logprobs, top_logprobs, modalities, audio, and web_search_options were read by nothing: a client that asked for JSON, three choices, or its own tool got none of them and no error. A value that asks for the default passes. /v1/responses already refused its own setting fields. POST /v1/conversations refuses initial items, which it used to drop.

• Agents inside run recording receive a plain AgentRunOptions. An IAgentDecorator with an Order above 0 no longer sees TraconRunOptions; read the run through TraconRunContext. Microsoft Agent Framework’s function-invocation middleware (AIAgentBuilder.Use with a FunctionInvocationContext callback) rejects any other options type, so it threw NotSupportedException on every run started by a Tracon endpoint. It now runs.

• /v1/chat/completions refuses tool-call history and unknown roles with 400. A tool or function message, an assistant message with tool_calls or function_call, and a role other than system, developer, user or assistant used to pass: the assistant turn was dropped, the tool result went on as plain text without its call id, and an unknown role became user. Tracon runs the agent’s tools on the server, and /v1/responses refuses function_call items the same way. A content part Tracon cannot hand to the model is refused by name, too.

• AddSpeechSynthesizer(name, null) and AddSpeechTranscriber(name, null) with a literal null no longer compile: the call is ambiguous between the factory and the binding overloads. Cast the null, or pass the factory.

• A harness agent that names skills and also calls other agents lists the skill tools after the background-agent tools, and puts the skill section of its instructions after the background-agents section. They were in the other order. A plain agent, and a harness agent that uses only one of the two, does not change.

Fixed

• A run’s events and its end are stamped with the TimeProvider its start came from. A run’s start came from the registered TimeProvider and its end and events from the system clock. With your own TimeProvider registered (a test clock, for example) a run seemed to last from the fake start to today, and the time a workflow continuation inherited from the run it continues was that gap. With the default clock nothing changes.

• A version number of a stored agent could name another content after the agent was deleted and created again. The numbering restarted at 1, so a pin to version 3 (a workflow step’s agentVersion, a loop reviewer, an experiment arm) or a tool approval that waited on version 2 reached the new agent’s third or second save a few edits later, and ran its text instead of failing. A run on an approval, for example, was resumed with the new agent’s instructions and completed. The numbering now continues, so the old number names no version and the run stops before any step with pins agent 'x' to version N, but the agent has no version N (a workflow) or fails (an approval resume). Version numbers a run recorded before the delete are not reachable any more, as they were not before. Needs the migration of the Changed entry above.

• A data subject erasure (DELETE /api/data-subjects/{id}?dryRun=false) did not return on SQLite. The audit entry is written before the erasure commits, from inside its transaction. On SQLite that transaction holds the database’s single write lock, so the audit write from a second connection waited until its command timed out, and the audit log retried the wait up to 50 times. On SQLite the audit entry is now written on the erasure’s own transaction, and the two commit or roll back together. PostgreSQL and SQL Server are not changed. An IAuditLog you register in place of Tracon’s own still writes on its own connection.

• OpenAI and Azure OpenAI never received the response schema as written, and nothing showed it. The Microsoft.Extensions.AI client rewrites the schema on every request, strict or not: it closes every object, lists every property in required (an optional property becomes required and its type does not gain null), and moves 22 keywords (maxLength, pattern, minimum, minItems and others) out of the schema into the property’s description. An optional nickname the model did not know came back as "". The behavior is not changed; the validation report now shows it (see above).

• The A2A and MCP exposure check refuses an agent whose skill tools ask for approval. The check read only the tool registry, and the skill tools are not in it, so an agent with skills was exposed and its first load_skill call closed the run Failed with approval_unanswerable (-32603 over A2A). The host now refuses the agent when it starts, names the agent and the way out (Skills.DisableReadApproval, or remove the skills), and opens it when the definition turns the read approval off. A host that exposed such an agent and relied on every call failing must set Skills.DisableReadApproval on the definition, or take the agent off the allow list. The check reads the catalog once, when the host starts: an agent saved later is not checked, and a model that calls run_skill_script still ends the run at the call unless a standing approval rule covers it.

• A tool that Microsoft Agent Framework already wrapped for approval reports that it needs approval. AddTool(new ApprovalRequiredAIFunction(fn)) — the default shape of DockerShellExecutor.AsAIFunction() — asked for approval at run time, but /api/tools said requiresApproval: false. The A2A and MCP exposure check read that flag, so such an agent was exposed and every call failed with -32603. The startup check now refuses it, and replay sees the approval.

• The .NET client reads a nullable enum property. ToolDescriptor.HostedKind, RunComparisonSide.ErrorClass, RunError.Class, WorkflowDescriptor.Kind, EvalCase.SourceKind and VoiceSession.EndReason were generated as an empty class named after the property in place of the enum, so the client threw JsonException when the host sent a value (The JSON value could not be converted to ...ErrorClass). They are the enum types now. A property the host always sends (WorkflowDefinition.Kind, WorkflowSaveRequest.Kind, RunErrorStatistics.Class) is no longer nullable in the client. The TypeScript client was not affected.

• A stored definition written before a list member existed no longer breaks the catalog. The SQL payload read mcpResourceUris, parameters, and the new extensionNames as null when a row had no such key, and the catalog listing failed with ArgumentNullException for every agent. The three lists now read as empty.

• A harness agent completes the turn that answers a pending approval. The approved (or rejected) tool ran, and then the next model call failed with InvalidOperationException: the harness reloads the session history on every model call, and the history still held the approval request while the response had been consumed. A plain agent was not affected.

• UseOpenAIImages and UseAzureOpenAIImages publish with Native AOT. The image generator now runs on the shared client’s pipeline instead of ImageClient, whose members name a System.ClientModel type that version 1.16 renamed; ilc stopped with “Failed to load type”.

• /v1/chat/completions hands image, audio and file parts to the model. It kept only the text parts, so the model answered as if the user had sent no image, and a message with only an image answered 400 “‘messages’ cannot be empty.” Embedded data passes the attachment type check and is stored as an attachment, as on /v1/responses.

• An image’s detail and a file’s name now reach the model on /v1/responses and on POST /api/agents/{name}/run attachments. The attachment reference dropped both.

1.0.0-preview.5 — 2026-10-17

The public API gets smaller before it freezes, and every dependency moves to its newest line. Twelve interfaces, 23 types that only they used, 81 HTTP request and response types and TraconAgentSessionStore leave the public surface; five service types lose their public constructors; AuthorizationConfigurationKey is removed from the MCP server types, and a migration moves the stored data. The runtime moves to Microsoft Agent Framework 1.25.0 and Microsoft.Extensions.AI 10.11.0. Tracon.Azure calls the Azure OpenAI v1 API, Anthropic ReasoningEffort becomes adaptive thinking, and a configuration value Tracon cannot read now stops startup. The release adds one migration to each SQL provider and breaks source in several places: read Upgrading from 1.0.0-preview.4 first.

Upgrading from 1.0.0-preview.4

• Migrations. PostgreSQL 0062, SQL Server 0050 and SQLite 0049 (remove_authorization_configuration_key). With AutoApplyMigrations (the default) they run at startup. Each one moves the stored authorization_configuration_key of an MCP server into its header_configuration_keys map as the Authorization entry, then drops the column. A row with OAuth on, or whose map already names Authorization in any letter case, keeps its map: the connection never read the old key there. An empty key moves nothing. Only the key name moves; no secret value is stored or touched.
• The column is dropped in the same migration, so there is no way back. A build from before the migration cannot read the table. Back up the database before the first start on this version.
• Every MCP connection reconnects once after the upgrade (its definition fingerprint changed).
• Public types changed or left the surface. Each entry below (Changed, Removed) says what to do:
  • McpServerDefinition.AuthorizationConfigurationKey and McpServerRequest.AuthorizationConfigurationKey are removed; declare the key name as HeaderConfigurationKeys["Authorization"]. PUT /api/mcp-servers/{name} answers 400 to a body that still carries authorizationConfigurationKey.
  • Twelve interfaces, 23 types, 81 HTTP request and response types and TraconAgentSessionStore are internal. A host that named one declares its own type, or resolves a service from DI.
  • IRunStore.UpdateRunCostAsync has no default for tenantId; pass the run’s tenant.
  • SingleTenantContext, HttpTenantContext, TimeoutAIFunction, CompiledAgentCache and DefaultRunAttributionContext have no public constructor; resolve them from DI.
  • OpenAILiveOptions.BackendModel, LiveVoiceSessionOptions.BackendModel, QuotaUsageQuery.AsOf and LiveVoiceDelegationMode.Responses are gone.
  • Tracon.Client: IMcpToolRefresher and the body parameter of TraconRefreshMcpToolsAsync are gone.
  • JobStoreContract gains a test; a third-party IJobStore that keeps a time limit in a 32-bit millisecond column fails it.
• Behavior changes most likely to reach an upgrade, each described in its entry below: a Tracon:Voice:Live:DelegationMode or Tracon:UtilityModel value Tracon cannot read stops startup; Tracon.Azure uses the Azure OpenAI v1 API and refuses an Entra token over plain HTTP; Anthropic ReasoningEffort is adaptive thinking; Tracon.Anthropic and Tracon.Google no longer promise Native AOT compatibility.
• A project that pins Agent Framework hosting packages next to Tracon moves them to the versions in the dependencies entry (Changed), or restore fails with NU1608 or NU1107.
• Pin every Tracon package to the same exact version. The pre-release Microsoft Agent Framework hosting packages are pinned at 1.25.0-preview.261014.1, Microsoft.Agents.AI.Hosting.OpenAI at 1.25.0-alpha.261014.1 and A2A.AspNetCore at 1.0.0-preview3.

Changed

• Tracon.Azure calls the Azure OpenAI v1 API. Requests go to {endpoint}/openai/v1/ through the plain OpenAI client, with the deployment name in the request’s model field and no api-version query string; Azure.AI.OpenAI is no longer a dependency (its stable line stopped at 2.1.0 in December 2024). The resource must support the v1 API. UseAzureOpenAI, AzureOpenAIProviderOptions and the registered provider name do not change; an address that already ends in /openai/v1 is used as it is. An API key is sent as Authorization: Bearer. An Entra credential now goes only over HTTPS: a CredentialFactory with a plain http:// address is refused at the first call instead of sending the token. The health check calls GET /openai/v1/models, sends the key as Authorization: Bearer like the chat call (it sent an api-key header), and reports unhealthy instead of sending an Entra token over plain HTTP. Image generation uses the same v1 endpoint (/openai/v1/images/generations). The Azure-only request fields (On Your Data) never worked with the OpenAI version in use and have no counterpart on the plain client; SupportedSettings stays empty.

• ModelBinding.ReasoningEffort becomes adaptive thinking on Anthropic. The request now carries thinking: {"type":"adaptive"} and output_config.effort (low, medium, high, xhigh). The budget form Tracon sent before (thinking.type = enabled with budget_tokens) is rejected with 400 by every current Claude model; the adaptive form is accepted by all of them (measured on the Claude 5 family). A model that predates adaptive thinking, claude-haiku-4-5, is the reverse: set anthropic.thinking.mode = enabled and anthropic.thinking.budgetTokens for it. A binding that names no ReasoningEffort sends the same request as before.

• Tracon.Anthropic and Tracon.Google no longer promise Native AOT compatibility. The promise is now a measured result: a Native AOT app that calls the provider through its real request and response path must publish with no trim or AOT warning and run. Tracon.OpenAI, Tracon.Azure and Tracon.Voice pass. The Anthropic SDK’s chat adapter fails on the first request under Native AOT, and the Gemini credential library publishes with about a hundred warnings. The packages’ own code is unchanged and stays analyzer-clean. The release rehearsal now publishes and runs a provider smoke, and fails when the compatibility page promises AOT for a provider package the smoke does not reference.

• IRunStore.UpdateRunCostAsync no longer defaults tenantId to null. The parameter stays string?; a caller now states the tenant on purpose. null skipped the tenant check, so a caller that left the argument out silently wrote a cost onto another tenant’s run. A call UpdateRunCostAsync(runId, cost) stops compiling: pass the run’s tenant. A store implementation drops = null from its own signature; the call shape does not change otherwise. The shipped RunStoreContract passes the tenant explicitly.

• Five service types keep a public type and lose the public constructor. The container, or the tool pipeline, builds them, and the guides and samples never call new on them: SingleTenantContext, HttpTenantContext, TimeoutAIFunction (both constructors), CompiledAgentCache and DefaultRunAttributionContext. Resolve them from DI. Their registrations are factories now; TryAdd and Replace behave as before, so an ITenantContext registered before AddTracon() still wins. A new test pins every public constructor of a concrete class, so the next service type cannot reach the surface unnoticed.

• Tracon:Voice:Live:DelegationMode refuses a name that is not a delegation mode. The host stops at startup with a message that names the setting. A misspelled name used to fall back to Client without a word.

• Tracon:UtilityModel refuses a number it cannot read. Temperature, TopP and MaxOutputTokens that do not parse ("abc", "1.5" for the token limit, "0,7") stop the host at startup with a message that names the key and the text as written. Such a value used to bind as 0, so a typo ran the context-compaction summarizer at temperature zero without a word. An empty or blank value still means “not set”: the provider default applies. Code that assigns TraconOptions.UtilityModel after binding still wins.

• Tracon.Client is regenerated with NSwag 14.7.1. Its public surface does not change. The client now passes the cancellation token when it reads the body of an unexpected response, so a cancelled call no longer waits for that body.

• Tracon.Testing.Contracts.Xunit keeps asking for xunit.v3.extensibility.core and xunit.v3.assert >= 3.2.2. The package was measured on xunit.v3 4.0.2 with Microsoft.Testing.Extensions.TrxReport 2.5.1; a project on either line restores without NU1608.

• Runtime dependencies move to the newest lines. Microsoft Agent Framework 1.25.0 (the hosting packages 1.25.0-preview.261014.1, Microsoft.Agents.AI.Hosting.OpenAI 1.25.0-alpha.261014.1, A2A.AspNetCore 1.0.0-preview3, all still exact pins), Microsoft.Extensions.AI 10.11.0, OpenAI 2.14.0, the .NET platform packages 10.0.13, Anthropic 12.58.0, Google.GenAI 1.26.1, Azure.Core 1.63.0 and Microsoft.Data.SqlClient 7.1.1. A project that pins Agent Framework hosting packages next to Tracon now gets NU1608 or NU1107 at restore, as before; move it to these versions. Behavior does not change: the Anthropic provider still sends ReasoningEffort as an extended-thinking budget, although the SDK’s own default is now adaptive thinking. Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.HashCode and Microsoft.Bcl.Memory leave the dependency graph of Tracon.Core (and so of Tracon and Tracon.Google): the token-counting data package now ships a net8.0 build.

• The console build tools move to their newest lines; building the console needs Node.js 22.22.2 or later on the 22 line, 24.15 or later on the 24 line, or 26 and above. TypeScript 7, Vite 8 (Rolldown), Vitest 5, jsdom 30 and React 19.3.1. The embedded console grows from 211.9 KB to 215.4 KB gzip (budget 250 KB), and the embeddable widget (embed/embed.js) still runs in strict mode: Vite 8 dropped the "use strict" directive and the build now asks for it. The embedded file set, the public API and the HTTP contract do not change. A contributor on Node.js 20 now gets an npm ci engine error that names the required version, not a wall of failing tests. The NuGet packages are not affected: a consumer does not build the console.

• The compiled dist/ of @tracon/client is byte for byte the same, in the same 23 files. Only the development dependencies in its package.json move (Vitest 5, @types/node 26.6); a consumer installs the same code and the same runtime dependency. It still builds with TypeScript 5.9, because openapi-typescript 7 needs the TypeScript 5 compiler API that TypeScript 7 does not ship.

Removed

• McpServerDefinition.AuthorizationConfigurationKey and McpServerRequest.AuthorizationConfigurationKey are gone (authorizationConfigurationKey on the wire; deprecated since 1.0.0-preview.3). The Authorization header is declared like any other credential header: HeaderConfigurationKeys["Authorization"] (headerConfigurationKeys on the wire). Code that sets or reads the member stops compiling. The same members leave the generated Tracon.Client types McpServerDefinition and McpServerRequest and the @tracon/client schema, and the field leaves both HTTP schemas. A third-party IMcpServerStore that persisted the field drops it and must keep HeaderConfigurationKeys (the shipped McpServerStoreContract gains Every_field_of_a_server_survives_a_round_trip). PUT /api/mcp-servers/{name} refuses a body that still carries authorizationConfigurationKey, with any value and in any letter case, with 400 (title Removed field) and a detail that names headerConfigurationKeys["Authorization"]. Without the rule the field would be dropped silently and the first tool call would fail with 401. Other unknown fields are still ignored. The console form writes the key name into headerConfigurationKeys.Authorization; an empty input sends no map, so a stored map is kept. The migration (see Upgrading) moves the stored data first.

• Twelve interfaces and the 23 types that only they used are internal. They are plumbing between Tracon’s own packages. No guide, sample or contract suite asks a consumer to implement one, and the shipped implementations are the only ones. IToolRegistry, IVoiceHealthCheck and IWorkflowRunner stay public: a guide names the first two, and IWorkflowRunner is the one public way to run a workflow in process. A host that registered its own implementation of one of these interfaces, or named one of the types, stops compiling. The types, by package:

  • Tracon.Abstractions (34): IAuditActorResolver, IAuditDecorated, IMcpOAuthCoordinator, IMcpPromptClient, IMcpResourceClient, IMcpResourceContextProviderFactory, IMcpToolRefresher, IStatePreflightReader, ITraconDrainState, IWebhookPublisher, IWorkflowFunctionCatalog, McpOAuthCompleteResult, McpOAuthOperationStatus, McpOAuthStartResult, McpOperationStatus, McpPromptArgumentSummary, McpPromptContent, McpPromptListResult, McpPromptSummary, McpRefreshOutcome, McpResourceContent, McpResourceListResult, McpResourceSummary, StateGenerationTally, StatePreflightTarget, StateSample, WebhookApprovalSummary, WebhookEvalSummary, WebhookEventPayload, WebhookJobSummary, WebhookQuotaSummary, WebhookRunSummary, WebhookScoreSummary, WorkflowFunctionDescriptor.
  • Tracon.AspNetCore (1): ITraconUiProvider.

• TraconAgentSessionStore is internal. Its base type, AgentSessionStore, has been [Experimental] since Agent Framework 1.22, and a public type cannot freeze a base its owner may still change. /v1/responses keeps using it unless the host registers its own AgentSessionStore; that registration always wins. No guide or sample built the class. A host that did, to wrap it in IsolationKeyScopedAgentSessionStore, supplies its own store instead. A store the host supplies replaces the Tracon-backed one for /v1/responses entirely: the tenant filter, the session ownership check and the sessions API of Tracon do not see those conversations. The store keeps session identities as before: the isolation partition of a key is folded into the identity as <escaped key>::<session id>, and a partition it does not know is refused.

• Four members that never worked or never did anything are gone. OpenAILiveOptions.BackendModel and LiveVoiceSessionOptions.BackendModel were read by nothing. QuotaUsageQuery.AsOf was [Obsolete] since 1.0.0-preview.3 and no store applied it; use PeriodStarts. LiveVoiceDelegationMode.Responses made every session that chose it fail at the provider with a 502; the enum keeps Client, the only mode. A BackendModel key left in configuration is ignored and the host starts.

• 81 HTTP request and response types are internal. They were public only so that the OpenAPI document could carry their descriptions. A .NET client does not use them: Tracon.Client generates its own types, and the HTTP contract does not change. Paths, methods, schema names, required, property types and $ref are identical, and the document keeps every description (see Fixed for the five that changed). A host that referenced one of these types declares its own record for the body or uses the generated client type of the same name. The descriptions now come from [Description], so a new HTTP type must carry it; a test fails the build when a schema or property loses its description. The types, by package:

  • Tracon.Abstractions (17): AgentValidationReport, CanaryDecisionKind, CanaryEvaluation, ContextWindowEstimate, DataSubjectErasureResult, ImageGenerationOperatorRequest, ImageGenerationOperatorResponse, JudgeFailure, JudgeRunResponse, RetentionPreview, RunCostRecalculationResult, SessionBranchRequest, SessionBranchResult, SpeakRequest, SpeakResponse, ValidationMessage, ValidationSeverity.
  • Tracon.AspNetCore (63): AcceptedRunResponse, AgentDetailResponse, AgentRollbackRequest, AgentSkillRequest, AgentVersionDiffResponse, ApiKeyCreateRequest, ApprovalDecisionRequest, CurrentTenantResponse, EvalCaseInput, EvalCasePromotionRequest, EvalRunDetailResponse, EvalRunTriggerRequest, EvalSuiteSaveRequest, ExperimentCanaryResponse, ExperimentResultsResponse, ExperimentSaveRequest, InboundTriggerAcceptedResponse, InboundTriggerResponse, InboundTriggerSaveRequest, JobDetailResponse, JobScheduleSaveRequest, JobTriggerRequest, LiveVoiceSessionCreateRequest, LiveVoiceSessionCreateResponse, LiveVoiceSessionStatusResponse, LoopCriterionCatalogResponse, LoopCriterionKindResponse, LoopJudgeModelResponse, McpOAuthStartResponse, McpPromptArgumentsRequest, McpRefreshResponse, QuotaSaveRequest, QuotaUsageResponse, RetentionPolicySaveRequest, RetentionRunTriggerResponse, RunComparisonResponse, RunComparisonSide, RunFeedbackRequest, RunInputResponse, RunReplayResponse, SearchKnowledgeHit, SessionDetailResponse, SkillScriptGrantRequest, TenantEgressPolicyRequest, TenantEgressPolicyResponse, TenantProviderBindingRequest, TenantProviderBindingResponse, TenantRequest, ToolApprovalRuleRequest, TraconAuthenticationMeta, TraconMetaResponse, TraconRoleMeta, TraconStorageMeta, UploadDocumentResponse, WebhookSaveRequest, WebhookTestResponse, WorkflowFunctionResponse, WorkflowRespondHttpRequest, WorkflowResumeHttpRequest, WorkflowRollbackRequest, WorkflowRunHttpRequest, WorkflowSaveRequest, WorkflowVersionDiffResponse.
  • Tracon.Core (1): OnlineEvaluationSummary.

• Tracon.Client.Generated.IMcpToolRefresher and the body parameter of TraconApiClient.TraconRefreshMcpToolsAsync. The class was never a request body: it was the server’s own refresher service, published by mistake as a schema. A call that passed null or nothing as the body drops the argument; TraconRefreshMcpToolsAsync(cancellationToken) sends the same request.

Added

• WorkflowRunRequest.DefinitionVersion. The version of a stored workflow’s definition to run, the same rule as WorkflowResumeRequest.DefinitionVersion: the run compiles that version and records it on its row. null (the default) runs the current definition; a version the workflow does not have fails the run and never falls back; a workflow defined in code ignores the value. The HTTP API does not set it.
• JobStoreContract checks a job time limit beyond 24.8 days. A_jobs_time_limit_beyond_an_int_of_milliseconds_survives_the_round_trip_and_the_lease writes a 30-day limit and reads it back from the enqueue, the read and the lease. A third-party IJobStore that keeps the limit in a 32-bit millisecond column now fails the contract.

Fixed

• A queued workflow run that recovery starts again, because the interrupted attempt wrote no checkpoint, now compiles the definition version that attempt recorded. It compiled the current definition, so a save made while the job waited changed what ran in the same session. Batch items restart the same way.

• Cancelling a run at the moment it finishes no longer fails with ObjectDisposedException. POST /api/runs/{id}/cancel answers 409 instead of 500, and cancelling a run tree still reaches every sibling. Closing a live voice session while a delegation finishes no longer ends the close with the same exception.

• UseLiveVoice(options => options.DelegationMode = …) with a value outside the enum stops the host at startup. It reached the provider on the first session and ended as 500.

• Anthropic prompt caching with anthropic.promptCaching.placement = system keeps the cached instructions in the top-level system array under Anthropic SDK 12.58. The SDK adapter now moves only the system messages in front of the first user or assistant message there; the provider appended the instructions block after the conversation, so it went out as a role: system entry inside messages and the cache breakpoint sat in the conversation. The block is now placed in front of the first non-system message.

• Five property descriptions in the OpenAPI document no longer carry an unresolved XML reference. WorkflowSaveRequest.nodes read IReadOnlyList<string>? WorkflowSaveRequest.AgentNames where the text means AgentNames; DataSubjectErasureResult.dryRun, JobScheduleSaveRequest.lane, InboundTriggerSaveRequest.payloadPath and InboundTriggerResponse.payloadPath had the same fault. @tracon/client and Tracon.Client carry the corrected text.

• POST /api/mcp-servers/refresh no longer declares a request body. The endpoint took its refresher service without [FromServices]; in a host without Tracon.Mcp the framework read the service from the body instead, so the OpenAPI document, @tracon/client and Tracon.Client carried a body schema (IMcpToolRefresher) for four preview releases. The request itself is unchanged. A test now fails the build when any endpoint reads a service interface from its body.

1.0.0-preview.4 — 2026-10-15

Workflows become a control plane for long-running pipelines that a person reviews. A run can be queued and resumes after a restart; a waiting request has one answer, an inbox and a time limit; every step has a time limit, cancellation, a cost record and a budget gate; and a graph written in code gets the same node capabilities as a saved chain, with a revision loop that is safe on a back edge. Speech gains multi-speaker dialogue and named providers chosen per tenant. The release changes the public API and adds seven migrations to each SQL provider: read Upgrading from 1.0.0-preview.3 first.

Upgrading from 1.0.0-preview.3

• Migrations. PostgreSQL 0055–0061, SQL Server 0043–0049 and SQLite 0042–0048. With AutoApplyMigrations (the default) they run at startup.
• Five public types changed. Each entry below says what to do:
  • IRunStore gains RecordNonTokenUsageAsync and ListNonTokenUsageAsync; a custom store adds both (Changed).
  • IWorkflowDefinitionStore gains GetVersionAsync, ListVersionsAsync and RollbackAsync; a custom store keeps the version history (Changed).
  • IWorkflowFunctionCatalog gains ValidateSettings (Changed).
  • TraconApiClient: three methods gain optional parameters; a call that passes skip, take or the cancellation token by position names the argument.
  • ModelProviderSettingsContract.SupportedSetting is now virtual and nullable; an existing override adds ? to its return type.
• One source break: AddWorkflowFunction<TInput, TOutput>(name, factory, null) is ambiguous (CS0121); pass a description or use the overload that takes options.
• Behavior changes most likely to reach an upgrade, each described in its entry below: a configuration value Tracon cannot read stops startup; answering a workflow request is audited before it runs, and an audit store that cannot write refuses the answer with 500; knowledge-base embedding applies the tenant’s egress policy; every run of a tree adds its spend to the quota; a harness-loop agent hands only its final iteration to a workflow step, the OpenAI-compatible and A2A streams and voice; functions and requests are reserved workflow names.
• Pin every Tracon package to the same exact version. The pre-release Microsoft Agent Framework hosting packages stay pinned at their 1.20.0 previews.

Known limitations

• The native agent stream (POST /api/agents/{name}/run) streams every harness-loop iteration, the loop’s feedback included, with no boundary between iterations. A client that shows that stream as the answer shows the drafts. Read the run’s loop.iteration-completed events, or use a surface that returns the final iteration (the non-streaming run, the OpenAI-compatible endpoints, a workflow step).
• In a graph written in code, an agent step’s version pin is fixed when the graph is built, and the graph is built for every run; there is no pin per production. A revision that runs after a new agent version is saved uses that version.

Security

• Answering a workflow’s pending human request is now the seventh fail-closed audit operation. Every POST /api/workflows/runs/{runId}/respond that starts a run writes workflow.respond (the source run, the request id, the run the answer starts, the response mode and a SHA-256 of the answer — never the answer itself) before the run starts, queued or streamed, in every response mode. Behavior change: when the audit store cannot write the entry, the answer is refused with 500 and no run, record or job is created; before, an answer was never audited. IAuditLog’s documented set grows from six operations to seven. The hash tells two answers apart; it does not hide an answer with few possible values, such as a yes or no.

• A refused provider setting no longer repeats its value. The Anthropic choice settings (anthropic.effort, anthropic.thinking.mode, the prompt-caching placement and TTL) and thinking budget, and the Google safety thresholds and thinking budget, wrote the rejected value into the message, which reaches logs and run records; a value can be a credential pasted into the wrong field. The message now names the key and the accepted values only.

• The built-in ElevenLabs client refuses a tenant credential with NotSupportedException on synthesis, streaming synthesis, dialogue and transcription. It does not take a tenant key; a caller that passed one directly was served on the configured key, so the host’s account paid for the tenant’s speech. The resolver never sends one, so calls made through Tracon are not affected.

• Knowledge base embedding calls now apply the tenant’s provider checks before the tenant’s text leaves the process. A document upload, POST /api/knowledge/{collection}/search and the search_knowledge tool called the registered embedding generator and read neither the tenant’s egress policy nor its own provider key. Name the provider in the new TraconKnowledgeOptions.EmbeddingProvider (Tracon:Knowledge:EmbeddingProvider); without it, the name the generator reports is used. Behavior change: a tenant with an egress policy that does not name the embedding provider, or with its own key for it, gets 403 on upload and search (new in the OpenAPI document and both generated clients) and a failed tool call. When no provider name is known, a tenant with a policy is refused; a tenant without one is not affected.

• A data subject export now returns protected columns as plaintext. With AddContentProtection(...) on, the export wrote the stored envelope of session state, run inputs and chat history, so the subject received ciphertext.

• Workflow checkpoint state is now a protected column (ProtectedColumn.WorkflowCheckpointState). It carries a workflow run’s messages and was stored in the clear even with content protection on. New checkpoints are encrypted when the column is in Columns (the default takes every column); existing rows stay readable. No migration.

• Data subject export and erasure now reach four more copies of a subject’s run: an eval case promoted from the run, the stored response of an idempotent request that started it, the job of a queued run (its id is the run id) and the batch item that started it. Behavior change: erasing a subject now deletes those rows, so an eval suite loses the cases promoted from the subject’s runs; a batch job keeps its other items. The erasure’s audit entry counts each target.

• A refused configuration key name is no longer echoed. An operator who typed a value, such as an API key, into a field that takes a configuration key name got that value back in the 400 body, and a webhook delivery wrote it to webhook_deliveries.error. The message now names the field and the allowed key space only. This covers every field that takes a key name: MCP server headers and OAuth secret, tenant provider bindings, webhook headers and signing secret, and inbound trigger secrets.

• A retention archive now hands protected columns to the IArchiveSink as plaintext. With AddContentProtection(...) on, the archive wrote the stored envelope of run event text and payload, tool call arguments and results, workflow checkpoint state, attachment content, session state and run inputs. Behavior change: a sink that stored those rows now receives the readable content; encrypt it in the sink if the archive must be encrypted at rest.

• A real data subject erasure now refuses with 409 while one of the subject’s runs is Queued or Running. Such a run could write its session and workflow checkpoint back after the erasure committed. The problem carries the run ids in activeRunIds; a dry run lists them in the new DataSubjectErasureResult.ActiveRunIds and erases nothing. Cancel the runs, or pass force=true to erase anyway. 409 and force are new in the OpenAPI document and both generated clients.

• Text-to-speech, speech-to-text and the voice list now apply the tenant’s provider checks before any text or audio leaves the process. The speak, transcribe and list_voices tools, POST /api/voice/speak, GET /api/voice/voices and the conversation socket called the setup-wide speech provider and read neither the tenant’s egress policy nor its own provider key. Behavior change: a tenant with a saved egress policy that does not name its speech provider (elevenlabs for the built-in client) can no longer synthesize, transcribe or list voices: the endpoints answer 403, the conversation handshake answers 403 before a connection slot is taken (an open conversation keeps the providers it was opened with until it closes), and a tool call fails. Add the provider name to the policy to keep speech working. A tenant with its own binding for the speech provider is refused unless the provider declares SupportsTenantCredentials; the built-in ElevenLabs client does not, so such a tenant is no longer billed to the host’s key. A binding with an endpoint override, or whose key has no value, is refused too. The policy is judged against the provider name the engine reports, never the name it is registered under.

• Image generation now applies the tenant’s provider checks before the prompt leaves the process. generate_image and POST /api/images/generate called the setup-wide generator and read neither the tenant’s egress policy nor its own provider key: a tenant whose policy did not allow the image provider still had its prompts sent there, and a tenant with its own key for that provider was billed to the host’s account. A policy that does not name Images:Provider now refuses the call, and so does a tenant binding for that provider, because the generator is built with the setup key and cannot use the tenant’s. The endpoint answers 403 (new in the OpenAPI document and both generated clients); the tool call fails with the same message. A run without a tenant scope now fails before the provider call instead of after it.

• A root agent run now counts its whole call tree in the tenant’s quota counters and in its run.completed/run.failed webhook. A child agent run never accounts on its own, and the root counted only its own tokens and cost, so the children’s spend reached no counter and a token or cost quota was exceeded through sub-agents. The root now adds what its child runs recorded; a workflow root already counted its tree. The webhook’s inputTokens, outputTokens and cost of an agent root are now the tree’s totals, the same meaning a workflow root’s event has. Costs in two currencies are not added; the root’s own is kept.

• A tenant endpoint on a provider added with UseOpenAICompatible() now goes through the outbound address guard, as on every other provider. The factory built the provider without the guard, so a tenant binding whose endpoint host name resolved to a private or metadata address received the tenant’s prompts and key; the binding save path checks only IP literals.

• One tenant can no longer stop a provider for every other tenant on the shared setup-time key. The circuit breaker counted every exception, so a tenant’s repeated 400s, an exhausted run budget, a history that names a deleted attachment, or a tool failure that the tool-call loop rethrows opened the provider’s circuit for everyone for the break duration. It now counts only a failure the provider client threw that shows the provider is unhealthy: no connection, a timeout, a 5xx, 408 or 429, or a 401/403, because a rejected key fails every caller in the same way. Any other permanent 4xx does not count, and a failure that does not count leaves the counter and a half-open circuit as they were. A test or runbook that opens the circuit with a 400 or a 404 now needs a 401 or a connection failure.

• Data subject export and erasure now include workflow checkpoints and the scores of the runs found through a subject’s sessions. Neither table has a foreign key to runs, so nothing cascaded to them: an erasure left the checkpoint state, which can hold the subject’s own messages, and the scores with their comments, and the export did not show them. A checkpoint’s state is exported as the stored JSON text. Erasure also removes the checkpoints of a run that waits for input: retention keeps them, erasure does not.

• A job that resumes an approved tool call (ApprovalResume, a built-in key a schedule can also enqueue) now fails when its payload names a different agent than the run that asked for approval, or when that run no longer exists. A hand-written payload could run another agent with the approved tool call.

• A failed workflow node no longer writes its exception’s own message to the run’s events. The run row already carried only the exception’s type and a correlation id, but the ExecutorFailed event of the same failure carried the raw message - a host and port, a request detail - to the event table, the SSE stream and every run event sink. The event now carries the same display-safe text as the row (<Type> failed. (ref: <id>), or a Tracon exception’s own message), and both name the same log entry.

• A harness agent no longer reads skills from, or writes memory files to, the server’s working directory. Microsoft Agent Framework’s harness falls back to the process’s working directory when it is not given a source: with no skill source it loaded every SKILL.md it found there, past the agent’s SkillNames, the skill’s enabled flag and the tenant’s scope; with no file store it wrote what the model chose under ./agent-file-memory, outside the tenant stores, retention and erasure. Every harness agent got both, including one saved from the console. Skills are now offered only when the definition names them, and file memory only when Memory.EnableFileMemory is true, on the registered AgentFileStore. A definition that names skills while Harness.DisableAgentSkillsProvider is true is refused when it is compiled; its skills were dropped without a word.

• A tenant’s egress policy and its own provider key now reach every model an agent calls, not only the agent’s own model. The model that summarizes the conversation during compaction (Compaction.SummarizationModel, or UtilityModel when the agent names none) and the judge of an aiJudge loop criterion were built without either. A definition that named a provider the tenant may not call compiled and ran, and each compaction sent the tenant’s conversation to that provider. Such a definition is now refused when it is compiled or validated, and the refusal names the provider. The summarizer uses the tenant’s own key when the tenant has one for its provider, so the tenant pays for it, and such an agent is not cached: a rotated or deleted key takes effect on the next run. The loop judge keeps the setup-time key: it is the host’s one judge model, the same one the run judge calls.

• A saved egress policy now reaches agents compiled before it. A compiled agent kept the policy decision of the moment it was compiled, so after a tenant forbade a provider, an agent already in memory kept calling that provider until its definition changed or the process restarted. The next run is now compiled under the saved policy and refused before any request leaves; a run already in progress is not stopped. Each run reads the tenant’s policy once to build the cache key.

• A standing approval rule for a tool of an MCP server is now bound to the server’s endpoint. An MCP tool is named {server}_{tool}, so when a key with the AgentsAdmin scope pointed a server at another endpoint (or deleted it and added it back under the same name), a rule a security administrator wrote for the old endpoint approved the new endpoint’s tool. A rule now records a fingerprint of the endpoint (sourceFingerprint, a SHA-256, never the address) when it is written, by an administrator or by the “don’t ask again” flow, and approves the tool only while the server keeps that endpoint. While a server’s tools are not discovered (its last refresh failed), its tools always ask, and POST /api/approvals/rules for one of them answers 409. Rules stored before this release carry no fingerprint: each standing rule for an MCP tool asks once more after the upgrade. ToolApprovalRule.SourceFingerprint is new and part of a rule’s identity; a custom IToolApprovalRuleStore has to store and compare it (see Changed).

• Saving an MCP server with requiresApproval: false now requires the SecurityAdmin scope as well as AgentsAdmin when the call uses an API key: for a new server, for a server that required approval, and for a server whose endpoint changes while approval stays off. The flag waives approval for every tool of the server, which is the decision only SecurityAdmin could make for a single tool; an AgentsAdmin key alone could switch it off and answers 403 now.

• A provider-hosted live voice session now obeys the tenant’s egress policy and its own provider key. The session is bound to a tenant, but the OpenAI live provider used the shared key and read no policy, so a tenant whose policy excluded openai still had its audio sent there, and a tenant with its own key was billed to the installation’s. POST /api/voice/live/sessions now answers 403 when the policy does not allow the live provider, when the tenant’s binding for it has no value, or when the provider cannot use the tenant’s key; a tenant with its own binding gets its own key on both the session creation and the sideband attach. A binding with an endpoint override is refused for a live session (403).

• Tracon.SqlServer no longer restores a System.Security.Cryptography.Pkcs with known vulnerabilities (GHSA-846f-f764-76mx, high; GHSA-2fmv-rv2c-59x7, moderate). Microsoft.Data.SqlClient pulls 8.0.1 on net8.0 and 9.0.13 on net9.0 and net10.0, and every SqlClient release up to 7.1.1 does the same, so a new project that used --persistence sqlserver restored with NU1902 and NU1903. The package now depends on the patched version for each target framework (8.0.2, 9.0.21, 10.0.13), which wins over SqlClient’s own. It adds no further packages to the graph.

Fixed

• A workflow run that reaches its time limit no longer ends its stream with an exception. When the limit fell between the moment an event arrived and the moment it was recorded, recording it on the run’s cancelled token threw TaskCanceledException out of the stream: the run was closed Canceled, but a streaming caller got the exception instead of the closing event. The run now stops there as it does between two steps.

• A job released for another attempt no longer loses that attempt. A failed attempt with attempts left makes the job leasable at once, and the worker could lease it again while the attempt that released it was still finishing on the same worker. It logged “already executing” and dropped the new lease, but the store had already counted the attempt: the job stayed Leased until the lease ran out and then failed as out of attempts without running again. The new lease now waits for the previous attempt and runs, unless that attempt finished the job.

• A pending workflow request whose type is a record of the graph’s own is answered correctly. The run that answers reads the request back from a checkpoint, where its data is JSON, and the plan-review check asked the framework to read that JSON as a Magentic plan review, every member of which is optional: a record such as {"text": "...", "violation": null} was taken for one, and the answer was built the wrong response type (Message type MagenticPlanReviewResponse does not match expected response type). The check now reads the port’s declared request type. The run that published the request held the live object and never showed the defect.

• A harness loop agent no longer hands its drafts to the caller that acts on its answer. A streaming loop yields every iteration, its drafts and its feedback included, and six surfaces read that stream as the answer: the next node of a workflow (a text-to-speech node spoke the rejected version), the next agent of a ready-made Sequential workflow, the streaming /v1/chat/completions and /v1/responses, the streaming A2A call, and the two voice surfaces, which spoke the drafts aloud. These surfaces now run a loop agent through the non-streaming path and stream its final iteration only; its usage stays the sum of every iteration. Behavior change: on these surfaces a loop agent’s answer arrives in one piece when the loop ends, not token by token. The native POST /api/agents/{name}/run stream is unchanged and still streams every iteration. A custom IAgentDecorator that does not delegate GetService hides the loop, and the agent then streams as before.

• An approval that ran out of time no longer erases what the run that asked had recorded. The expiry closed the run Failed with a completion built from nothing, and IRunStore.CompleteRunAsync replaces the event count, usage and cost of the row with what the completion carries, so a run that had spent tokens before it paused lost its usage, its cost and its event count. The expiry now reads the run first, closes it only while it is still AwaitingApproval (a run something else closed keeps its outcome), and writes those values back.

• Tracon:Retention:IdempotencyKeys is now bound from configuration. Its MaxAgeDays and Archive keys were ignored and the target kept its one-day default; only code (Configure<TraconRetentionOptions>) could change it. A configuration that sets them now takes effect, and MaxAgeDays below 1 fails startup like every other target.

• /v1/chat/completions now reports why the answer ended. finish_reason was always "stop", so an OpenAI SDK caller could not tell a cut-off answer from a complete one. Behavior change: an answer the model stopped at its output token limit or at its context window is "length", and an answer a content filter cut off after it produced text is "content_filter", on the JSON response and on the last chunk of the stream (data: [DONE] still ends it). The value comes from the answer’s final model call; a tool turn’s reason is never reported, and run recording does not need to be on. A filtered answer with no content still fails with 502 (error on the stream), and a cut-off structured answer still fails as before.

• A failed read of the quota threshold notice no longer fails the agent run’s stream. With TraconQuotaOptions.PublishThresholdToRunStream on, a run store error while the stream read the notice back ended the stream of a completed run with an error frame. Behavior change: the stream now logs a warning and ends with done, without the notice; the notice stays on GET /api/runs/{id}/events.

• A tenant’s quota now counts what a call tree spends after its root run ended. The root read its tree from the run store once, while its own row closed, so a child agent still running in the background at that moment (a root that starts a task and answers without waiting) never reached a counter, and neither did the amount a tool reported after its call timed out and its run closed. Behavior change: every run of a tree now adds its own tokens and cost to the counter when it ends, under the root’s tenant and name (a child adds no run: the tree is still one run), and a tool amount that arrives after its run closed is added to the counter once, in Tracon:Pricing:Currency. The counter and GET /api/runs/{runId} give the exact total; the run.completed webhook is unchanged and shows the tree as it stands when the root closes. A threshold crossed by a child run is written to that child’s own event stream (with Quotas:PublishThresholdToRunStream; read it from GET /api/runs/{runId}/events) and its quota.threshold webhook names that run; a tool amount that crosses one is announced by the webhook only. A child priced in another currency than Tracon:Pricing:Currency adds its tokens and the amounts it reported beyond tokens, not its token cost. A store of your own needs no change; QuotaStoreContract has two cases for an entry that adds tokens and cost and no run.

• A job no longer repeats a failure the next attempt would get again. The worker retried every handler failure up to the attempt limit: an eval whose judge was cut off at its output limit ran its unfinished case and paid for it on every attempt, and a queued run whose model answered a permanent 4xx ran again too. Behavior change: a failure whose stable type is output_truncated or tenant_provider_refused, or a model provider failure (upstream_error) with a 4xx other than 408 and 429, fails the job on that attempt. The decision reads the type, never the message; an exception a consumer handler throws itself keeps its retries, and so does JobRetryException. A workflow node retry and the online evaluation read the same decision.

• A tenant’s refusal of a provider is no longer classified by its text. Its error type was the .NET type name, and a tenant or provider name with “timeout” or “429” in it made the refusal a transient fault that a workflow node retried. Behavior change: every refusal (model, fallback, summarizer, loop judge, image, speech, embeddings, live voice) is the new TraconTenantProviderRefusedException, error type tenant_provider_refused, with the new class RunErrorClass.TenantProviderRefused (in the OpenAPI document and both generated clients). A compilation no longer wraps it as TraconCompilationException (compilation_failed); the message still names the agent. A binding that names a configuration key the tenant may not read is a refusal too: the image, speech and knowledge endpoints answer 403 for it, not 500. The model path’s refusal of a tenant credential its provider cannot use was provider_credential_unsupported and is now tenant_provider_refused too. The image and live voice refusals name their kind of provider instead of “model provider”.

• A provider failure masked as upstream_error that answered 429 is now RateLimited, not ProviderError, and a status .NET carries only on HttpRequestException.StatusCode now reaches the record ((HTTP 401)).

• An Anthropic answer cut off by the context window (model_context_window_exceeded) and a turn the API paused (pause_turn) no longer complete the run as finished. The SDK’s adapter reported both as a plain stop. A cut-off structured answer now fails with output_truncated and a plain one writes tracon.output.truncated, both naming the context window; the event payload gains a cause field (output_limit or context_window). A paused turn is continued, its blocks sent back as the API returned them, up to five times; a turn still paused fails the call. New: TraconFinishReasons.ContextWindowExceeded, a finish reason any provider can report.

• A SQL store write that the server picks as a deadlock victim is run again. The SQL Server upsert gave error 1205 to its caller under concurrent writes. Every store transaction now opens at one boundary that runs the whole transaction again, up to five times, on a new connection.

• A failed webhook send whose result could not be recorded kept its retry delay. The store error used to replace the send’s failure: the job was released at once, and on the last attempt the delivery stayed Pending. It now ends Failed.

• TraconToolUsage.Report refuses a measurement the record cannot hold, as a function node’s item is refused. An oversize unit, provider or model reached the insert, and on PostgreSQL and SQL Server the failed insert lost the call’s whole record.

• GET /api/voice/voices answers 502 when the provider fails, as POST /api/voice/speak does; it answered 500 (new in the OpenAPI document and both generated clients).

• The first function node of a workflow node list runs once per run. A run sends the first node the user’s message and then Microsoft Agent Framework’s turn token, on every start and resume, and a first node that takes object received both and ran twice — a node with an outside side effect did it twice. Behavior change: saving a node list whose first node takes object answers 400, and a stored one fails before its first node runs; declare List<ChatMessage> or IEnumerable<ChatMessage>.

• No money total adds amounts in two currencies. A run tree, the totals and breakdowns of GET /api/stats, the points of GET /api/stats/timeseries, an experiment arm and the online evaluation’s judge cost added the runs’ amounts and labelled the sum with one of their currencies (the in-memory store the first, the SQL stores the alphabetically largest). When the runs are in more than one currency, the total now keeps no amount and no currency, and the new CurrencyCount says how many there are; letter case is not a second currency. RunSpend.Total for a tree returns null for such a tree, so the quota and the run.completed webhook no longer count a mixed sum: an agent root counts its own cost. The console shows mixed currencies.

• A run whose caller can never answer its tool approval no longer waits forever. /v1/chat/completions answered 200 with empty content; it now answers 409 with the error type approval_required (or, on a stream, an error frame of that type and no [DONE]). POST /api/agents/{name}/run without a sessionId answered 200; it now answers 409 with errorType approval_unanswerable (or an error event instead of done). In both, and for an agent exposed over MCP or A2A, the run closes Failed with the error type approval_unanswerable; an MCP task poller still sees the refusal. The 409 responses are new in the OpenAPI document and both generated clients.

• A queued turn that ends at a tool approval no longer calls the model again when the approval cannot be written. The write is tried again within the lease, and a write the store committed but reported as failed is not written twice; past the lease the job fails with tracon.job.approval-save-failed and the run closes Failed.

• A structured-output agent (Json or JsonSchema with validation on) whose turn stops at a tool approval or at a client-side tool call no longer fails with “The response is empty.” Such a pause is not validated; the turn that carries the decision or the tool result is.

• A workflow run stopped by a graceful shutdown keeps its checkpoints while ResumeInterruptedRuns is on, also with KeepCheckpointsAfterCompletion off. They were deleted when the stopped run closed, and its continuation ran every finished step again; the continuation now removes them when it finishes.

• An agent can name a skill that exists only under a skill root (SkillRoots). The catalog and the definition check looked in code and in the store only, so such an agent failed with “the skill was not found” and no HTTP run reached a script on disk. A disk skill is installation-wide like a code skill; a stored skill under the same name shadows it for its tenant. An edit to its SKILL.md reaches the next run.

• The Tracon:Knowledge configuration section is now read. TraconKnowledgeOptions was documented as bound from it, but every value there was ignored; only code that called Configure<TraconKnowledgeOptions> changed a setting. A Dimensions value in configuration now takes effect: it must match the migrated vector column.

• A draining process (Drain.Enabled) now refuses every new run it would start itself, not only the agent run endpoint. The workflow run, resume and respond endpoints and run replay started a run during the drain; they now answer 503 (new in the OpenAPI document and both generated clients). /v1/chat/completions and /v1/responses answer 503 in the OpenAI error shape with type service_unavailable, the voice conversation handshake answers 503 before the upgrade, an MCP tools/call returns an error result and an A2A message fails. A trigger, eval, schedule or approval still writes its job, which waits for a worker that is not draining.

• A provider error with an empty or non-OpenAI body is now read with its HTTP status. System.ClientModel (OpenAI, Azure OpenAI) writes Status: 404, the Anthropic SDK Status Code: NotFound and Google.GenAI status code 404; only HTTP 404 was read. Such a 401, 403 or 404 moved to the next fallback link, and such a 400 or 404 counted against the circuit that every tenant on the setup key shares. The stored provider error now names the status for these failures too, so their error fingerprint changes once. A cancellation that a tool or a Tracon ring raised no longer counts against the provider’s circuit; the provider client’s own timeout still does.

• A queued agent run, or the agent run of an inbound trigger, no longer stays Queued forever when the queue refuses its job. The placeholder row was written first and never closed; it is now closed as Failed, as the queued workflow run already did, and the request still fails.

• A batch item or an eval case whose run stops at a tool approval now fails, and its run is closed as Failed. Both run without a session, so the approval could never be answered: the run stayed AwaitingApproval with no inbox entry, and the batch reported the item Completed. The queued agent run already had this rule.

• A document whose text the content guard masks stays a document in the run record. The masked message was rebuilt as plain text, so RunStarted.Text held the document’s text and no DocumentAttached event was written. The record now takes the name and the text as they read after masking, or the name [masked document] when the masked text no longer reads as one document. The original name and summary are not recorded.

• The model calls of an evaluator added with AddEvaluatorJudge are now recorded. Each judgment writes one judge:{name} run of kind Eval with the calls’ usage and cost, and the cost reaches the judge cost metric, as the built-in model judge already did. Before, nothing wrote this spend down. A failing evaluator closes its run as Failed and still throws.

• The in-memory job store now changes a job item only while it is pending, as the SQL stores do. It overwrote a finished item, so a late report from a worker whose lease had expired rewrote the result the job already gave.

• Scheduling:Lanes, Scheduling:MaxConcurrentJobsPerLane, Scheduling:LaneByHandlerKey and Scheduling:HttpSchedulableHandlerKeys are now read from configuration. The four keys were documented and bound nowhere, so a lane budget in appsettings.json was ignored and the worker leased every lane. A list that is present replaces the default. A per-lane budget that is not a number now fails at startup with the lane named, instead of being skipped.

• A webhook delivery now honors Egress:AllowPrivateNetworkTargets. The subscription was saved under that setting, but the delivery job checked the target against the default egress options and dropped every delivery to a private address; only Webhooks:AllowPrivateNetworkTargets worked.

• A queued run no longer fails, or runs a second time, when its session cannot be saved once after the model has answered. The handlers that end a queued turn (a queued run, the continuation of an approved tool call, the continuation of an interrupted run) saved the session inside their own failure path: one store error failed the job while its run said Completed, or released the job and called the model again. The save is now tried again with a growing pause while the worker holds the lease. If it still fails, the job fails with tracon.job.session-save-failed, whatever its attempt limit, and the model is not called again. A run that asked for approval closes Failed with the same code, because its approval cannot be answered without the session.

• A run that resumes after an approval decision and asks for another approval now puts that request in the approval mailbox. Only the queued-run handler wrote pending approvals, so the resumed run closed AwaitingApproval, GET /api/approvals/pending answered an empty list, and the chain stopped. A run that continues an interrupted run had the same gap. Both now save the session first, list the approval second and announce it with approval.pending, as a queued run does.

• The sub-agents and tools of a queued run now see the run’s labels, and those of a resumed or continued run see its user and labels. The job payload now carries labels next to userId, and a resumed or continued run runs under the user and labels of the run it continues, not the approver’s. A workflow or agent batch that runs from the queue now carries the user and labels of whoever queued it: IJobDispatcher captures the attribution IRunAttributionContext resolves at the time of the call, and an inbound trigger keeps the accept request’s (an agent run it starts recorded none either). A schedule’s payload can name one in an envelope, {"items": [...], "userId": "...", "labels": {...}}; an envelope that breaks a label limit is refused with 400. A context you register yourself sees the replayed attribution only if it reports AmbientRunAttributionScope outside a request; the reference sample’s demo context now does.

• An evaluation run whose cases have all run is no longer marked Failed when the write that closes it fails. The handler now tries the write again for a third of the job lease; if the store still refuses it, the next attempt runs no case again and only repeats the write.

• A webhook delivery the receiver accepted is no longer sent again because Tracon could not record the result. The result writes are now tried again for a third of the job lease, a write that still fails is logged with a reference, and a retry that finds the delivery already settled sends nothing. Delivery stays at-least-once: deduplicate on the X-Tracon-Delivery header.

• An eval case’s context now reaches the agent, through the document channel ahead of the query, as a run with documents sends it. A case ran as its query alone and the context went to the evaluator only. The evaluator still receives it, and the case run now records the parameter values it was bound with.

• Promoting a run to an eval case now copies the run’s recorded input: the whole query, the documents it carried (into context, one block per document) and the parameter values it was bound with (into parameters). It read only the RunStarted event, which is cut at MaxPayloadLength (8 KB by default), and dropped the documents and the values. Without a recorded input the query still comes from that event and keeps its …[truncated] marker; a run that carried documents with no recorded input, an attachment, or a message besides its documents and its request is now refused with 422. Requirement: an IEvalStore stores the new EvalCaseDraft.Parameters in AddCaseAsync.

• On a SQL provider, a replay, a continuation or an approval resume of a run that carried documents now records them as documents. The stored document marker came back as JSON values the recorder did not recognize. The console’s case editor also keeps the line breaks of a case’s context.

• A fallback on the binding of the compaction summarizer or of an aiJudge loop judge no longer rewrites the run. runs.model_id named the judge’s fallback model, the agent’s own tokens were priced at that model, and the run got a ModelFallbackUsed event its own model never caused. The run now keeps the agent’s model and gets no event, the side call’s tokens are priced at the fallback model that answered, and the switch is logged.

• POST /api/workflows/runs/{runId}/respond now refuses an answer that does not fit the pending request’s port with 400 before the event stream opens, as its contract said, and opens no run. The answer was translated only inside the resumed run, after the 200, and the new run ended Failed. A request recorded by 1.0.0-preview.3 or earlier does not carry its response type’s assembly; for it a data value that does not read into the type is still reported on the stream.

• Saving a Sequential node list now checks that each node takes what the node before it passes on, and that the first node takes the run’s List<ChatMessage>. Microsoft Agent Framework drops a message no handler takes without an error, so such a chain was saved with 200 and every run ended Completed with no output. The save answers 400 naming both nodes and both types, and a stored chain that does not fit now fails its run before the first node. The site, the Tracon.Workflows README and the AddWorkflowFunction examples showed a string function after an agent; they now take List<ChatMessage>.

• Automatic run continuation no longer treats a workflow run or a sub-run as an agent turn. An orphaned workflow root was queued as an agent continuation under the workflow’s name, and a workflow step or a callable agent’s run was continued on its own, repeating its tools in its root’s session. Such a run now stays Failed with a RunContinuationBlocked event; for a workflow run the event names POST /api/workflows/runs/{runId}/resume. A continuation queued before the fix is refused the same way. The refusal event is now written for a run of any tenant, and MaxAttempts above 1 counts every earlier continuation of another tenant’s chain.

• A retention policy with archive: true no longer deletes rows it never archived. Each batch was read in time order for the IArchiveSink and then deleted as a separate batch in no order; with more matching rows than one batch, rows that never reached the sink were deleted (measured on PostgreSQL, SQL Server and SQLite). A run now deletes exactly the rows the sink received, by key, after the sink returns. A sink can receive a row more than once.

• Documentation now matches the code: a failed workflow node’s message rule and the causes of a Canceled workflow run, the request options a fallback link inherits (temperature, TopP, MaxOutputTokens, ResponseFormat and tools carry over; only provider settings do not), the five gates and the waiting quota of a tool call, the console editor keeping a harness loop, and how a job handler learns about cancellation (JobContext.IsCancelledAsync). The XML of JobHandlerKeys.Workflow, TraconOptions.SkillRoots, MaxOutputBytes (per stream), ToolCallUsage, ModelFallback and ModelBinding was corrected. A resume from a checkpoint whose graph changed now says the graph’s structure differs instead of naming one cause.

• Every documented webhook event is now published. workflow.request.pending, job.completed, job.failed and eval.completed were defined, accepted on subscribe and listed on the site, but no code published them, and a workflow run produced no run.* event at all (its agent steps are child runs). A workflow root now publishes run.completed/run.failed with the run tree’s tokens and cost, and one workflow.request.pending per request it waits on (ids only, no prompt). A job publishes job.completed or job.failed when it reaches that status (a cancelled job and a webhook delivery job publish nothing). An evaluation run publishes eval.completed when it completes, is cancelled, or fails on its last attempt. The console’s subscription form now also offers run.score.low.

• Retention and data subject erasure now delete an attachment’s bytes in a registered IAttachmentStorage. Retention’s attachments target never read external_uri, so the bytes stayed in object storage for ever; it now deletes the bytes before the row, and keeps the row (and tries again on the next run) when the byte delete fails. Erasure deletes the bytes after the row deletes and before the audit write and the commit, and rolls back when a byte delete fails. IAttachmentStore.DeleteAsync and DeleteBySessionAsync also delete the bytes first: a storage failure after the row was gone lost the location for good. Requirement: an IAttachmentStorage.DeleteAsync must succeed for a location that no longer exists.

• Retention no longer treats a workflow’s attachments as orphaned while a run of that session waits for input, is still running, or finished after the cutoff. A workflow session has no session row, so an image or a speech clip an agent step produced was deleted seven days after it was made, even while the run waited in AwaitingInput. Ownership also requires the same tenant.

• The continuation that a tool-approval decision queues now runs on the agent version of the run that asked for approval, and counts in the same experiment arm. It ran the current version, so a version saved while the approval waited changed the instructions halfway through the turn. Code agents still run their current definition. An automatic continuation after a crash now keeps the interrupted run’s experiment arm, not only its version.

• A queued run (Prefer: respond-async) now uses the request’s culture and takes part in a running experiment. The worker resolved the agent with no culture and the current version, so a queued run always got the default instructions, ignored the experiment and counted in no arm. The arm is now assigned when the request is accepted, with the same key as a synchronous run (sessionId, else the run id), and the worker runs that arm’s version. The worker honors an arm in the job payload only when it matches a started experiment of the job’s tenant and agent with that exact version; otherwise the job fails and no model call is made.

• A store error after a job’s handler has finished no longer counts as a handler failure. The worker wrote the outcome inside the handler’s own try, so one failed database call either failed a job whose work was done — a queued agent run (one attempt by default) became Failed while its run was Completed — or, with attempts left, ran the handler a second time. The worker now retries the write with a growing pause while it can still prove its lease, and stops a third of the lease before that lease could run out; a write that keeps failing is logged as an error and the job takes the lease-expiry path. A store error while releasing a failed attempt, or while failing its last one, no longer leaves the job Running until its lease expires. In a batch, a store error while recording a finished item no longer records that item as Failed.

• A workflow run now carries its attribution the way an agent run does. The root built its run scope before it read IRunAttributionContext, so every node and tool of a workflow read TraconRunContext.Current.UserId and Labels as null while the run row carried them, and its quota record named no run and no user, so a quota.threshold webhook for a workflow carried runId and userId as null.

• A harness loop with an aiJudge criterion now records the judge’s tokens in the run’s usage, cost and quota consumption. The judge calls its own model on every iteration it reaches, and the framework drops that response: the tree budget counted the judge, but the run record, the run’s cost and the tenant’s quota did not.

• The tokens of the context compaction summarizer are now priced at the summarizer’s own model. They were priced at the agent’s model, while the tree budget priced them at the summarizer’s.

• The tree budget now charges a streamed model call with the sum of its usage reports. It kept only the last report, while the run record sums them, so a call that reports usage in more than one part was undercounted against MaxTotalTokens and MaxTotalCost.

• A consumer’s own speech provider now works with UseVoice() as documented. With ISpeechSynthesizer and ISpeechTranscriber registered before UseVoice() and no voice key, the first read of the voice settings threw: POST /api/voice/speak called the provider, saved the attachment, then answered 500 and left the attachment behind. Provider, ApiKey and Endpoint are now validated only while the built-in ElevenLabs client serves at least one of the two contracts; a registration added after UseVoice() fails at startup with a message that says to register first. Three behaviors now follow the bound implementation instead of the ElevenLabs settings: prices are looked up under its ProviderName (Tracon:Pricing:Voice:{ProviderName}:{model}, and only the built-in client falls back to its default model), the speak tool applies ISpeechSynthesizer.MaxCharactersPerRequest as the HTTP endpoint already did, and GET /api/voice/health uses the synthesizer’s own IVoiceHealthCheck or a voice-list call that reports its ProviderName.

• Speech audio saved by POST /api/voice/speak is now named after its detected type (.ogg, .wav, .mp3) instead of always .mp3, and audio a live conversation saves with PersistAudio is no longer named .bin. Speech, conversation and image attachments now share one naming rule, and their timestamps carry ticks.

• The console can now answer a workflow request that it did not start. The run page sent the operator to “the workflow screen”, but that screen showed a request card only for a run it had started itself, so a run started over HTTP, by a job or in another tab could not be answered from the console at all. The workflow screen now opens on the run named by ?runId=. Both links on a run page carry it, and the screen writes its own run there, so a reload or a copied link keeps the run. A runId of another workflow, or of a run that is not waiting, shows a note instead of a card. The run page now also says that answering an already answered run opens a separate branch.

• A workflow node retry, the model fallback chain and an online evaluation judge no longer repeat a permanent client error. RunErrorClass.ProviderError covers every provider HTTP error, 4xx included, and the node retry read only that class: a node that got a 401 from EnsureSuccessStatusCode(), or a model call that got a 404 (model_not_found), ran WorkflowNodeRetryPolicy.MaxAttempts times, and a retried 409 on a non-idempotent call could repeat its side effect. The fallback chain moved to the next provider on any 4xx other than 401/403 that an SDK exception type carried, so the next provider got the same bad request, and an online evaluation job retried a judge whose model answered 401 or 404. A failure that carries a permanent HTTP status (every 4xx except 408 and 429, read from HttpRequestException.StatusCode or from HTTP nnn text in the exception chain) is now thrown on the first attempt, never moves to the next link, and fails the judge’s item without a retry. Behavior change: a registered IRunErrorClassifier can no longer make such a failure retry a workflow node; an IProviderRetryClassifier that returns Retry still moves to the next link. runs.error_class values are unchanged.

• A harness agent on the OpenAI Chat Completions provider (openai, azure-openai and a compatible registration) no longer fails with 400. The harness sent the provider’s hosted web search on every request (unknown_parameter: web_search_options for a model that does not search; it is now off by default, see Changed), and a streamed run lost the conversation after its first tool call: the next request carried only the system message and the tool result (messages.[1].role). The harness’s history layer wrote a marker onto each streamed update, and the tool loop under it, holding the same object, took the conversation for one the service stores. Each update now reaches the harness as a copy.

• HarnessSettings.MaximumIterationsPerRequest now bounds the tool-call loop. It reached the harness’s own loop, which never sees a tool call: the loop that runs the tools kept its default of 40, so a limit of 2 still made 7 model calls. The limit now reaches that loop and the loop of every fallback model, and at the limit the last call offers the model no function tools. A value below 1 is refused when the agent is compiled.

• A fallback model runs the agent’s tools with the agent’s ModelBinding.AllowConcurrentToolCalls. The fallback link built its client from the provider and model alone, so concurrent tool calls turned off when the chain moved to a fallback.

• A workflow run whose node works quietly for a while is no longer cancelled by its own silence. The workflow stream wrote nothing between events, the console stops reading a stream after 30 seconds of silence, and a closed connection cancels the run - so any node that took longer ended the run Canceled. Every streaming endpoint (agent and workflow runs, resumes and answers, and the OpenAI-compatible endpoints) now writes an SSE comment whenever it has written nothing for TraconEndpointOptions.StreamKeepAliveInterval (15 seconds by default; see Added). A workflow run that waits for a MaxConcurrentRuns slot now has its run record from the start: a run whose RunTimeout passed while it waited closed the stream with no closing frame and left no record behind; it now ends Canceled with the timeout error like any other timed-out run. Any other error on the workflow stream now ends it with an error frame instead of a dropped connection.

• The job queue now keeps its lease, attempt and cancel promises. A failed lease renewal stopped renewal for the rest of the job, so the lease ran out under a working handler and a second worker ran the job alongside it; renewal now retries on the next tick and runs at a third of the lease instead of half. A job whose worker died was leased again without checking its attempt limit, so a queued agent run (one attempt by default) ran twice; a job past its limit now fails without running, with the error code tracon.job.attempts-exhausted. A cancelled job whose handler then threw went back to Pending and ran again, or became Failed; a job that reached a final status no longer changes, and a job cancelled between its lease and its start does not start.

• A workflow step whose agent cannot answer now fails the workflow. A step that ran past AgentGraph:ChildDeadline, was refused by the tree budget (MaxTotalRuns, tokens, cost or time), asked for a tool approval, or whose provider never answered returned the refusal sentence as its answer: the next node received that sentence as its input and the run ended Completed. The run now ends Failed: a wait limit with the new TraconChildRunTimeoutException (class Timeout), the budget with TraconRunBudgetExceededException (class QuotaExceeded), a provider fault with the provider’s own error. An agent called as a tool by another agent still gets the refusal as text, so its model can react.

• A pending human request of a workflow run can no longer become impossible to answer. A long prompt - about 1,400 non-ASCII characters is enough - was cut at the event payload limit, the request disappeared from the pending list and respond refused it; the request is now listed with its prompt cut and marked, and it can be answered. Retention deleted the request event and the checkpoints of a run waiting for an answer; it now keeps them for as long as the run waits. With KeepCheckpointsAfterCompletion = false, an answer - even one the port rejected - deleted the checkpoints the waiting run needs; the cleanup now leaves a session’s checkpoints in place while another run of the session waits or is running.

• A harness loop run now records the tokens and cost of every iteration. A non-streaming loop returned and recorded only its last iteration’s usage, and a streaming run of any agent recorded only its last model call - a loop, or a run with a tool round, undercounted its cost and the tenant’s quota. The usage of a streamed run is now the sum of its model calls.

• Structured-response validation now checks the agent’s answer, not everything the response holds. With a loop, or with text the model wrote before a tool call, the validator received the joined text and rejected a valid final JSON as “not valid JSON”. It now validates the last assistant message that carries text.

• A parameterized agent no longer runs with its placeholders unfilled. Only POST /api/agents/{name}/run and evaluations bound parameter values; a queued run, a batch, a replay, the OpenAI-compatible endpoints, MCP, A2A, a workflow step, an agent called as a tool and voice sent the model the literal {{name}}, without even the defaults. Every path now binds the defaults. An agent with a required parameter that has no default is refused where the request enters - 400 with missingParameters for a queued run, 400 on the OpenAI-compatible endpoints, an error for an MCP or A2A call, a failed job for a batch - and fails before any provider call on a path with no request to refuse. A replay and an automatic continuation are refused for any agent that declares parameters: the recorded input has no parameter values, and the defaults would change the instructions. An evaluation of a parameterized definition registered in code now binds each case’s values. A parameterized definition registered in code (AddAgent(AgentDefinition)) is now checked and bound on POST /api/agents/{name}/run; its parameters were refused there as unknown.

• A run pinned to an earlier definition version (an evaluation or an experiment) is now validated, priced and recorded as that version. The catalog compiled the pinned version but described it with the current one, so its response was validated against the current response format, and the run recorded the current model, cost and - for an evaluation case - version. An evaluation run now records the pinned version’s model.

• GET /api/evals/runs/{id} no longer fails with 500 on the in-memory store when a case’s run threw. A free-form JSON field left unset (Scores, Checks, a job’s Payload) held no JSON at all and could not be written; it is now the empty array, as when it is set to nothing.

• A dependency that times out on its own no longer counts as the caller cancelling. An HTTP-backed store, sink, catalog, cache or identity seam reports HttpClient.Timeout as TaskCanceledException; 58 catch sites let that exception through as if the request had been cancelled, which broke each site’s own promise. Among the effects: the MCP and A2A startup check stopped the host when the agent catalog timed out, a run failed because a run store, event sink, response cache or attribution lookup timed out, an approved turn never ran because its “don’t ask again” rule could not be written, a trigger delivery whose queueing timed out could never be retried (the retry was refused as a replay), queued runs and evaluation runs stayed Queued/Running forever, and image generation and replay answered 500 instead of their documented 502. Every site now tells the two apart by the operation’s own token.

• An IRunEventSink now receives a run’s events in sequence order, as its contract states. A run writes from several places at once (concurrent tool calls, a child run, a workflow’s steps), and an event numbered later could reach the store and the sinks before an earlier one. Numbering, the store write and the sink dispatch of one event are now a single step. A sink must not append to the run it is handling: such an append throws InvalidOperationException and the sink is disabled for the run, instead of waiting for itself. The in-memory run store also returns events in sequence order.

• Editing a workflow that uses function nodes in the console no longer erases them. The editor opened such a workflow with an empty participant list, and saving it after adding an agent replaced the whole chain with that agent. The editor now lists the chain read-only, keeps the kind Sequential, and sends the chain back unchanged.

• Editing a quota in the console keeps a disabled rule disabled. The form sent enabled: true on every save. The agent and the period of a rule are now locked while you edit it: they identify the rule, and changing them wrote a second rule.

• Editing a draft experiment no longer removes its canary policy when the in-memory store is in use. The SQL stores already kept it.

• Saving a webhook subscription through PUT /api/webhooks/{name} now resets its consecutive failure count with the SQL stores too, as the in-memory store already did. Before, a subscription that was disabled for failing and then enabled again went back to disabled on its next single failure.

• A live voice session, a voice conversation and an agent batch job now pick up an MCP server change on their next delegation, turn or item. Each resolved its agent once and ran with it until it ended, so after a server was edited or deleted mid-session every later call went to the closed connection (the model heard “Error: Function failed.”), and a server switched back to requiring approval ran its tools without asking. They now resolve the agent again each time; nothing is recompiled while nothing changed. A batch item whose agent was deleted meanwhile fails on its own.

• A cached agent now sees an MCP tool’s description and input schema as the server last listed them. The compiled agent kept the tool definition of the moment it was compiled, so after a server changed a tool on the same connection, the model kept getting the old description and schema until the agent’s definition changed or the process restarted.

• One failed tools/list call no longer takes an MCP server’s tools away. A server whose listing failed once lost all its tools at that refresh, and every agent that used one was refused as “not registered” until the next good refresh (five minutes by default). The last good list is now kept for Tracon:Mcp:StaleToolRetention (default 15 minutes) after it was read, while the server stays registered with the same definition. TimeSpan.Zero keeps the old behavior.

• A timeout set beyond what .NET timers accept now fails at startup with the option’s name. CancelAfter refuses more than about 49.7 days, and the validators refused only zero and negative values, so such a value threw where the timeout was armed: on every run of a workflow (Workflows:RunTimeout), every webhook delivery (Webhooks:Timeout), every live voice delegation (Voice:Live:DelegationTimeout), every MCP connect (Mcp:ConnectionTimeout, which aborted discovery for every tenant), at shutdown (Drain:Timeout), and after a skill script had started, which left the script running (Skills:Scripts:Timeout). The same check now covers Tools:DefaultTimeout, Tools:ApprovalPresentationTimeout, Validation:McpTimeout, AgentGraph:ChildDeadline and WaitTimeout (and an agent definition’s subAgents values, at compile time), Images:Timeout, Voice:Conversation:IdleTimeout and MaxConnectionDuration, a tool’s own timeout, and RunEventPollInterval. A provider or voice Timeout, which becomes an HTTP request timeout, must be at most about 24.8 days (int.MaxValue milliseconds); TraconClientOptions.Timeout likewise. A WorkflowNodeRetryPolicy with a negative delay or multiplier is refused when the function is registered, and its growing delay is capped. tracon eval refuses a --timeout or --poll-interval it cannot wait for. Values below one millisecond are refused too.

• On SQL Server, two requests that save the same new record at the same time no longer fail with a unique-key violation. Twenty stores wrote with an update-then-insert pair outside a transaction, so both requests could take the insert branch: among them sessions, runs, quotas, script grants, approval rules, MCP servers, tenants and the singleton lease. Each pair now runs inside a transaction, which costs two round trips on SQL Server and nothing on PostgreSQL or SQLite. A script grant, quota or approval rule saved with an empty string in a nullable key is no longer matched to the record saved with null there; the HTTP surfaces already store an empty value as null.

• A provider setting value of the wrong JSON type (for example text where anthropic.thinking.budgetTokens expects an integer) is now reported with the key it belongs to. Through the model provider registry the message was replaced with “The model provider request failed.”, so POST /api/agents/validate and a compilation error did not name the key.

• A run that failed because the provider filtered its response (ContentFiltered) now records the tokens the call spent in its usage, cost and quota entry. The run recorder writes no usage for a run that ends in an exception, so a filtered run said it cost nothing although its input was billed.

Added

• Function nodes and agent steps for a workflow graph built in code. GetWorkflowFunction(name[, configure]) binds a function registered with AddWorkflowFunction and GetWorkflowAgentStep(workflow, agent[, configure]) binds a catalog agent as a plain step, so a hand-built graph with a way back and a human gate gets what a stored chain’s steps have: the time limit, the retry policy, the budget gate, a cost line that names the node, the strict read of the settings (WorkflowFunctionStepOptions.Settings, or typed with SetSettings) and an agent step’s own timeout and version pin (WorkflowAgentStepOptions). Until now the wrapper that carries them was reachable only from a stored chain’s compiler, and the budget gate could not be built in consumer code. An agent bound with GetWorkflowAgent still cannot be the target of a back edge (it runs only after a turn token), so the agent step is the way to put an agent where a message returns. An unknown function or settings that do not fit end the run Failed before its first node, naming the workflow and the node; a version pin that cannot hold fails the step by name before its model call.

• WorkflowRegistrationOptions.RunTimeout and WorkflowRegistrationOptions.Parameters give a workflow defined in code the run time limit and the parameter schema a stored definition has. The run timeout shortens Tracon:Workflows:RunTimeout or lengthens it up to MaxRunTimeout, and a value above the ceiling stops the host at startup, naming the workflow. With a schema, GET /api/workflows lists it, the run endpoint answers 400 early for an unknown or missing value, a queued run carries the values, and a run that is answered or resumed uses the recorded ones. Without one, every value is still refused as unknown.

• WorkflowFunctionOptions.MaxConcurrency limits how many calls of a function run at the same time in the process, across workflows and tenants, in a stored chain and in a graph built in code. A call that finds every slot taken waits; the wait ends when its run is cancelled or reaches its deadline and is not part of the node’s Timeout; each attempt of a retried node takes a slot of its own; the budget gate is read after the slot is taken. The limit is per process, so replicas multiply it.

• A workflow run that the request expiry service fails now publishes run.failed, with the payload any failed workflow run carries. Until now such a run was closed in the store and the webhooks heard nothing, so a pipeline driven by webhooks waited for a run that had ended. A run closed Completed (every request answered) publishes nothing: its answer’s own run published run.completed.

• A list of the human requests a tenant’s workflow runs wait on, and a time limit for them. GET /api/workflows/requests (state is pending, answered or all; workflowName, skip, take) lists one item per request, oldest first, across every workflow; it needs the Reader role and read access to runs, and a registered IRunAuthorizationHandler that refuses reading runs rejects it with 403 instead of filtering it. WorkflowPendingRequest gains workflowName, sessionId, expiresAt, answered and lastResponseRunId, on this list and on GET /api/workflows/runs/{runId}/requests; IWorkflowRunner gains ListRequestsAsync, with a default that lists nothing. The same request id in the same session is one request: an answered run stays AwaitingInput and its continuation publishes the open requests again, so the item names the newest run that waits on it. The list is built from a new workflow_requests table (one migration for each SQL provider) that the engine writes when a run starts waiting and the respond endpoint marks answered; it holds no copy of the prompt, which is read from the run’s event. A run that started waiting before the migration has no row and is not in the list. The console lists the same requests in a Workflow requests panel on the Approvals screen.

• A workflow can give its human requests a time limit. WorkflowDefinition.RequestTimeout (requestTimeout on PUT /api/workflows/{name}, the Answer time limit field in the console’s editor, WorkflowRegistrationOptions.RequestTimeout for a workflow defined in code) is from one minute to 365 days and counts from the moment the run published the request. A background scan (Tracon:Workflows:RequestExpirationScanInterval, one minute, and MaxRequestExpirationsPerScan, 100; one instance of a cluster scans) closes the run when its last request passes: Failed with the error type WorkflowRequestExpired (error class Timeout) when something went unanswered, Completed without an error when every request had been answered. An answer to a closed run is refused with 400, as for any run that is not AwaitingInput. The run keeps its usage, cost and event count. A run that waits keeps the limit of the version it started with. This is what lets retention release what a waiting run keeps: its request event, checkpoints and run input row were never deleted while it waited, and an answered run waits too. The new workflow_requests retention target (Tracon:Retention:WorkflowRequests, 30 days after the request expired) deletes the closed rows of the list. Behavior change: requests joins functions as a workflow name that cannot be saved, because GET /api/workflows/requests matches before GET /api/workflows/{name}.

• Tracon.Testing.Contracts.Xunit: WorkflowRequestStoreContract for IWorkflowRequestStore, the seam behind the list; a custom store passes it the way it passes the other store contracts. The request store also lists the runs a stopped process left waiting (IWorkflowRequestStore.ListStrandedAsync): the scan closes a request before its run, and the instance that takes the scan lease next closes the runs whose requests were closed and which still wait. WorkflowDefinitionStoreContract gains The_request_timeout_survives_the_round_trip; a custom IWorkflowDefinitionStore that keeps its own copy of a definition must carry RequestTimeout.

• One answer per workflow request. WorkflowResponseMode (Branch, the default, and SingleAnswer) is set on a stored definition (WorkflowDefinition.ResponseMode, responseMode on PUT /api/workflows/{name}) or on a workflow defined in code with the new AddWorkflow(name, factory, Action<WorkflowRegistrationOptions>) overload, and is reported on WorkflowDescriptor. In SingleAnswer, two identical answers to one request — a double click, a retried call — start one run: the second follows it (the same SSE frames read from the stored run, or the same 202 with Prefer: respond-async), and a different answer gets 409, which names neither the run nor the other answer. An answer whose run failed or was cancelled before the workflow received it can be given again and starts a new run; a queued answer whose job is still waiting or running is followed instead, because the job’s recovery owns that work. Two answers that arrive together may both open a run before one of them claims the request: the other closes its own run as Canceled with the error type request_already_answered and no events (no webhook, metric or event sink fires for it), and its audit entry names that run. That run is still a run: it is listed by GET /api/runs and counted in RunStatistics.CanceledRuns, so it is part of the ErrorRate denominator. A waiting run is answered under the mode of the definition version it recorded. Branch keeps opening a new run for every answer. A queued SingleAnswer answer whose job was never written (the process stopped after the answer was recorded and before the job was queued, or the queue refused the job and its Queued run could not be closed) is finished by a repeat of the same answer: the repeat writes the job and follows the run, and two repeats at the same time write it once. Known limit: when a process stops in the middle of a streamed SingleAnswer run, the run stays Running and a repeat of the answer follows it forever. Only run reconciliation (Tracon:RunReconciliation:Enabled, off by default) closes it: reconciliation closes Running runs whose heartbeat stopped and reads no Queued run. Turn reconciliation on where such a request must stay answerable after a crash.

• GET /api/workflows/runs/{runId}/responses lists the answers given to a run’s requests: who answered, when, the run each answer started and its state. The records live in the new IWorkflowResponseStore (in memory by default; the new workflow_responses table on PostgreSQL, SQL Server and SQLite). A record is removed only with its source run, by a data subject erasure; no retention target deletes runs, so the table grows with the run history. A store implementation is checked with the new WorkflowResponseStoreContract in Tracon.Testing.Contracts.Xunit.

• RunEventType.WorkflowResponseApplied (workflow.response-applied on GET /api/runs/{runId}/events): the run an answer starts names the run it answered and the request id right after it starts, even with RecordToolPayloads off. The console’s run timeline links it back to the source run.

• The console shows which pending requests already have an answer, links the run that answer started, says when a one-answer workflow refused a different answer, and has a “One answer per request” switch in the workflow editor and the version comparison.

• The live stream of an agent run (POST /api/agents/{name}/run without Idempotency-Key) now says when the answer was cut off. A plain-text answer the model stopped at its output token limit or at its context window completes, and its tracon.output.truncated event (RunEventCustomTypes.OutputTruncated) was only on GET /api/runs/{id}/events; a client that read the live stream took the partial answer for a complete one. The stream now sends that event as a custom frame right before done, always, with the same data /events serves. Each recorded event is one frame: a harness loop whose iterations were cut sends more than one, and a tool turn cut off in the middle of the run sends none. With the quota notice on, both notices arrive in record order. A client that reads frames by name and ignores unknown customType values needs no change. No event, and so no frame, is written while run recording is off.

• TraconFinishReasons.ContextWindowExceeded: the finish reason a model provider reports when the conversation and the answer filled the model’s context window. Tracon treats it as a cut-off answer and names the window.

• RunErrorClass.TenantProviderRefused (17): the tenant’s provider rules refused the call before any provider was called.

• TraconTenantProviderRefusedException: the one exception every path throws when the tenant’s provider rules refuse a call (its egress policy, a credential binding that cannot be resolved, a provider that cannot take the tenant’s own key). Catch it to tell the tenant’s rule from a provider failure.

• CurrencyCount on RunTreeCost, RunNonTokenCost, RunStatistics, TimeSeriesPoint and ExperimentVariantResult, and JudgeCostCurrencyCount on OnlineEvaluationSummary: how many currencies the runs behind a money total are priced in. Above one, the total carries no amount (see Fixed).

• Skill scripts can run outside the Tracon host. Register an ISkillScriptExecutor (new in Tracon.Abstractions, with SkillScriptExecutionRequest, SkillScriptOrigin and SkillScriptExecutionResult, which moved there from an internal Core type without its Duration) to run an approved script in a container, a micro-VM or a remote runner. The gates, the content pin, the script.run audit entry, the concurrency quota, a wait limit of Timeout plus five seconds and the output cap stay with Tracon; the executor decides only where the script runs. UseSkillScripts registers the built-in executor, a local process as before, as a default that a host’s own registration replaces in either order; RequireCustomBinding<ISkillScriptExecutor>() stops the host while the built-in one resolves. Tracon.Testing.Contracts.Xunit adds SkillScriptExecutorContract and ContractCoverage.ScriptContracts. See the new guide Write your own script executor.

• Multi-speaker dialogue synthesis. ISpeechDialogueSynthesizer voices an ordered list of turns, each with its own voice, in one request (SpeechDialogueRequest, SpeechDialogueTurn) and returns one audio result with each turn’s time range (SpeechDialogueAudio, SpeechDialogueSegment) and the provider’s limits (SpeechDialogueCapabilities). Code takes it from the new ISpeechProviderResolver.GetDialogueSynthesizerAsync(name), which reads the capability from the registered synthesizer and applies the tenant’s egress policy and own-key rules; nothing registers the capability in the container. The built-in ElevenLabs client implements it with text-to-dialogue and its timestamped variant, refuses a request over 10 voices or VoiceOptions.MaxDialogueCharactersPerRequest (new, default 2,000) before the call, and uses VoiceOptions.DialogueModelId (new) or the provider’s default model, never SynthesisModelId.

• Provider request settings for speech. SpeechRequest.ProviderSettings and SpeechDialogueRequest.ProviderSettings carry keys under the provider’s prefix; the built-in client reads elevenlabs.stability, similarityBoost, style, useSpeakerBoost, speed, seed, previousText, nextText and previousRequestIds (ElevenLabsProviderNames) and refuses an unknown key, a wrong type, a value out of range, and on a dialogue a key the dialogue service does not take. ModelProviderSettings.Validate gains an overload that takes the settings dictionary, for a speech provider of your own.

• SpeechAudio.ProviderRequestId carries the provider’s id for a generation (the ElevenLabs request-id header), to pass in elevenlabs.previousRequestIds for the next part of a long script.

• A workflow function node can be bounded by a timeout. AddWorkflowFunction<TInput, TOutput> gains an overload that takes Action<WorkflowFunctionOptions>, and WorkflowFunctionOptions.Timeout sets the registration’s timeout; a node’s own WorkflowNodeReference.Timeout (timeout in PUT /api/workflows/{name}) wins over it. When it passes, the handler’s token is cancelled and the run ends Failed with the new TraconWorkflowFunctionTimeoutException (error type workflow_function_timeout, class Timeout). The run stops waiting even for a handler that ignores its token; its late end is logged and its result is discarded. With a retry policy the timeout applies to each attempt. GET /api/workflows/functions shows the registered timeout (WorkflowFunctionResponse.Timeout).

• An agent node of a Sequential node list can carry its own timeout, which replaces Tracon:AgentGraph:ChildDeadline for that step; the hard cutoff stays 30 seconds later. Past it the run ends Failed with child_run_timeout, and the message names the node.

• WorkflowDefinition.RunTimeout (runTimeout in PUT /api/workflows/{name}): a definition’s own run timeout. It may shorten Tracon:Workflows:RunTimeout, and may be longer only up to the new TraconWorkflowOptions.MaxRunTimeout (Tracon:Workflows:MaxRunTimeout, unset by default); a longer one is refused with 400 on save, and a stored one above a ceiling lowered later is cut to it with a warning.

• A job’s time limit: JobRequest.MaxDuration and JobRecord.MaxDuration, and TraconSchedulingOptions.MaxDurationByHandlerKey (Tracon:Scheduling:MaxDurationByHandlerKey) for every job of a handler key; the job’s own value wins. Past it the worker cancels the handler’s token and the attempt fails with JobErrorCodes.MaxDurationExceeded (tracon.job.max-duration-exceeded); the job is leased again with the full limit while attempts are left, and a handler that returns normally after the limit completes the job. The built-in workflow handlers end the work instead: the run closes Canceled with the error type job_max_duration_exceeded and is never continued, a queued run’s job fails at once, and a batch fails the item. New column jobs.max_duration_ms (migrations PostgreSQL 0057, SQL Server 0045, SQLite 0044). JobStoreContract adds A_jobs_own_time_limit_survives_the_round_trip_and_the_lease and A_job_without_a_time_limit_reads_back_none; WorkflowDefinitionStoreContract adds Node_timeouts_and_the_run_timeout_survive_the_round_trip and Saving_again_without_timeouts_clears_them. A third-party store must keep both fields.

• The console’s workflow editor has a timeout field on each step of a chain with a function step, and a run timeout field.

• A workflow run, resume or answer can be queued: POST /api/workflows/{name}/run, POST /api/workflows/runs/{runId}/resume and POST /api/workflows/runs/{runId}/respond accept Prefer: respond-async and answer 202 Accepted with the run id (AcceptedRunResponse, now in the OpenAPI document and both generated clients). The caller is checked before the 202 as on the streamed call, the run’s row is Queued until a worker starts it, and POST /api/runs/{id}/cancel cancels it from the queue. A queued run no longer depends on the connection, so a client that stops reading does not cancel it. The job runs under the new built-in key JobHandlerKeys.WorkflowRun (tracon.workflow-run), which no schedule can use.

• Idempotency-Key on the three workflow run endpoints, accepted only together with Prefer: respond-async; a key on a streamed call is refused with 400.

• TraconWorkflowOptions.ResumeInterruptedRuns (off by default) and MaxResumeAttempts (default 1): a queued workflow run or a tracon.workflow batch item interrupted by a crash, a deploy or a graceful stop continues from the latest checkpoint in its chain when its job is leased again, as a new run whose ContinuedFromRunId names the interrupted one. The step that was running repeats. Turning it on without EnableCheckpointing fails at startup. A queued run’s job gets 2 + MaxResumeAttempts attempts while it is on: the job’s last attempt never starts a continuation, because the worker fails a lease past the limit before the handler runs; it closes the chain instead. A batch job keeps its own attempt limit and needs 2 + MaxResumeAttempts attempts to get every continuation.

• RunQuery.ContinuedFromRunId and GET /api/runs?continuedFromRunId= walk a continuation chain forward.

• A structured tracon.workflow batch item may name a sessionId: the run’s execution session, which its run.completed webhook and its continuations carry. An agent batch item that names one fails alone.

• RunStoreContract adds A_second_start_without_a_continuation_link_keeps_the_first_one, A_queued_workflow_row_keeps_its_workflow_session_and_attribution_when_it_starts, Query_filters_by_the_run_a_continuation_continues and Query_by_continuation_does_not_return_another_tenants_run. JobStoreContract adds A_pending_report_marks_the_item_and_counts_nothing and A_report_for_a_finished_item_changes_nothing. A third-party store needs the first and the last of these: the second start of a run keeps a stored ContinuedFromRunId, and a report for a finished item is ignored.

• Named speech providers: AddSpeechSynthesizer(name, factory) and AddSpeechTranscriber(name, factory) register more text-to-speech and speech-to-text engines next to the default one, and ISpeechProviderResolver (registered by AddTracon()) returns one by name after the tenant’s checks — for a workflow function node, for example. SpeechProviderDescriptor and SpeechProviderKind describe a registration. A name is 1 to 64 characters of a-z, 0-9, ., _ and -; a repeated name throws at setup.

• GET /api/voice/providers lists the registered speech providers (new in the OpenAPI document and both generated clients). POST /api/voice/speak takes an optional provider and GET /api/voice/voices an optional ?provider=; an unknown name answers 400, a request without a name when no default is registered 501.

• Tenant credentials for speech providers: ISpeechSynthesizer and ISpeechTranscriber gain SupportsTenantCredentials (default false), SpeechRequest and SpeechTranscriptionOptions gain Credential, and ISpeechSynthesizer gains ListVoicesWithCredentialAsync, whose default refuses a credential. All are default interface members or new init properties, so an existing implementation keeps compiling.

• SpeechAudio.ModelId and SpeechTranscript.ModelId carry the model that did the work, and IVoicePricingReader gains ForSynthesis(providerName, modelId, characters) and ForTranscription(providerName, modelId, duration) (default null). A speech call is priced by the model the provider reports, then the one the request named; the built-in client reports its model.

• IWorkflowRunner.ValidateResponseAsync: checks an answer against the pending request before the stream opens. A default interface member, so an existing implementation keeps compiling.

• IRetentionStore.ArchiveBatchAsync reads one batch, hands it to the archive, and deletes exactly that batch. Its default implementation keeps the old two-call behavior so an existing store compiles, and can delete rows it did not archive — override it. RetentionStoreContract adds Archive_batches_delete_only_the_rows_they_archived, A_failed_archive_write_deletes_nothing and a SeedOldRowAsync(tenantId, startedAt) hook.

• EvalCaseDraft.Parameters: the parameter values a promoted run was bound with. EvalStoreContract adds AddCaseAsync_stores_the_parameter_values_of_a_promoted_run.

• RunStoreContract.ClaimOrphanedRunsAsync_reports_the_kind_and_the_tree_position_on_the_claimed_record: a custom IRunStore returns Kind, ParentRunId and Depth on a claimed record, because continuation decides on them.

• WebhookEvalSummary and WebhookEventPayload.Eval: the payload of the eval.completed webhook.

• WebhookRunSummary.Kind: Agent or Workflow, on every run.* webhook.

• OpenAIProviderNames.SettingsPrefix (openai) and OpenAIProviderNames.SupportedSettings (empty).

• HarnessSettings.EnableWebSearch: turns on the model provider’s hosted web search for a harness agent.

• TraconEndpointOptions.StreamKeepAliveInterval: the longest a streaming endpoint stays silent before it writes an SSE comment. Default 15 seconds; keep it below the shortest idle timeout between the server and its readers, and below 30 seconds while the console is in use.

• JobErrorCodes.AttemptsExhausted (tracon.job.attempts-exhausted).

• TraconChildRunTimeoutException (error type child_run_timeout, class Timeout), with AgentName and Timeout.

• A harness loop can fail the run instead of returning a response no criterion accepted. LoopSettings.OnExhausted (the ceiling is reached while a criterion still asks for another iteration) and LoopSettings.OnCriterionError (a criterion throws) take a LoopOutcome: ReturnLastResponse, the default and today’s behavior, or FailRun. Exhaustion fails with TraconLoopUnsatisfiedException (error type loop_unsatisfied, new class RunErrorClass.LoopUnsatisfied = 15); a criterion error fails with the criterion’s own error. A workflow stops at that agent. With OnExhausted = FailRun the turn at the ceiling is evaluated before the run is failed - one more evaluation, which for aiJudge is one more judge call - and the LoopIterationCompleted event gains failsRun. JSON takes the names ("onExhausted": "FailRun"); an unknown name is refused with 400. A run the loop fails keeps the usage and cost of every turn it ran.

• TraconMcpOptions.StaleToolRetention.

• ILiveVoiceProvider.SupportsTenantCredentials and ILiveVoiceProvider.AttachSessionAsync(LiveVoiceAttachRequest), both with default implementations, plus LiveVoiceCreateRequest.Credential and LiveVoiceAttachRequest. A live voice provider that sets SupportsTenantCredentials receives the tenant’s own key on both calls of a session; one that does not is refused for a tenant with its own binding.

• ToolApprovalRule.SourceFingerprint.

• A workflow can declare run parameters, and a run carries values to every agent step. WorkflowDefinition.Parameters, WorkflowDescriptor.Parameters, WorkflowSaveRequest.Parameters, WorkflowRunRequest.Parameters, WorkflowRunHttpRequest.Parameters and GetRunParameters() (an extension on IWorkflowContext, for a function node). A step receives the values its own schema names; an invalid value is a 400 before the stream opens, and a participant whose required parameter nothing supplies fails the run before its first model call. A resume or an answer to a waiting run reads the values back, and is refused when the workflow now declares parameters and the run recorded none.

• A queued agent run (Prefer: respond-async) accepts parameters and documents, and a batch item can be a structured object ({"message", "parameters", "documents"}) for tracon.agent-batch and tracon.workflow. jobs.payload and the item inputs are not content-protected and now hold these values in plain text.

• RunInputRecord.Parameters, ProtectedColumn.RunInputParameters (10) and a nullable run_inputs.parameters column on all three storage providers (PostgreSQL 0056, SQL Server 0044, SQLite 0043). null means nothing was recorded and {} means the run had no values; the retention policy keeps the row of a run waiting for a human.

• RunReplayRequest.Parameters: values laid over the ones the source run was bound with.

• A workflow function can take settings, so one function serves several workflows with a different configuration in each. AddWorkflowFunction<TInput, TOutput, TSettings> (two overloads: a plain one and one that takes an Action<WorkflowFunctionOptions> for the description and the retry policy), WorkflowNodeReference.Settings (a JSON object, or null), WorkflowFunctionDescriptor.SettingsType and SettingsSchema, WorkflowFunctionResponse.SettingsSchema (GET /api/workflows/functions) and TraconWorkflowOptions.MaxNodeSettingsLength (16 KiB). A save reads the settings into TSettings: an unknown field, a missing required member, a value of the wrong type and a null where the member does not allow one are a 400 that names the node and the member, as are settings on an agent node, on a function that declares none, or that are not an object. The read repeats when a run starts, so settings saved against an older shape fail the run by name before any node runs. A change applies to the next run, and an older checkpoint stays usable. Settings are stored in the definition and the audit trail: never put a secret in them. The settings member of a stored node is also part of the workflow list and the generated clients.

• The console builds the chain of a Sequential workflow: add an agent or a function (from GET /api/workflows/functions), reorder, remove, and edit a function step’s settings as JSON with the function’s fields listed under it. The editor writes nodes when the chain holds a function and agentNames otherwise, tells you when a save changes that, and warns that a run waiting for input cannot be resumed after a change of pattern, steps or order. The server accepts both forms, so a definition saved over HTTP in the other form keeps loading.

• AddLoopEvaluator(kind, Func<IServiceProvider, LoopEvaluator> factory): a loop stop criterion created from the application’s root services. The factory runs once, on the first compilation of an agent that names the kind, so it can take IAgentCatalog; a factory that throws is not cached and fails that compilation with the kind named. Each AddLoopEvaluator overload has a variant with a description, which the console shows next to the kind.

• GET /api/loop-criteria (LoopCriterionCatalogResponse, LoopCriterionKindResponse, LoopJudgeModelResponse, in the OpenAPI document and both generated clients): the built-in and code-registered loop criterion kinds with their descriptions, and the aiJudge judge model’s provider and model, or null. Reader role, AgentsRead scope. Listing runs no factory.

• The console’s agent editor edits the harness loop: criteria (add, remove, reorder, per-kind fields), the iteration ceiling, the fresh-context switch and both outcomes. A kind the host does not list is kept and marked. The version diff shows the loop.

• A response the model stopped at its output token limit is now its own outcome. A structured (Json or JsonSchema) response fails the run with error type output_truncated and the new RunErrorClass.OutputTruncated (TraconOutputTruncatedException in-process); no structured-response repair turn runs, and the StructuredResponseRejected event carries repairSkippedTruncated when one was left. A plain-text response completes and the run writes a tracon.output.truncated event (RunEventCustomTypes.OutputTruncated). Only the turn that ends the run decides; a tool call cut off in an intermediate turn does not. The tokens of the cut-off call count in the run’s usage and cost. The new enum member is in the OpenAPI document and both generated clients.

• Anthropic provider settings anthropic.effort (output_config.effort: low, medium, high, xhigh, max), anthropic.thinking.mode (enabled or adaptive), anthropic.promptCaching.ttl (5m or 1h) and anthropic.promptCaching.placement (request or system, which marks the end of the agent’s instructions so requests with different documents share the cached prefix). A wrong value, a cache setting without anthropic.promptCaching = true, and a thinking budget with adaptive mode are errors. Nothing changes for an agent that sets none of them.

• ModelDescriptor.SupportsSampling, read from a provider’s Models catalog entry. When it is false, a definition that sets Temperature or TopP (on the binding or a fallback link’s model) fails to compile, and POST /api/agents/validate reports sampling_unsupported at model.temperature or model.topP. GET /api/models returns supportsSampling; null means unknown and checks nothing.

• POST /api/agents/validate warns with output_truncation_risk when a binding leaves MaxOutputTokens empty, the provider sends a lower default limit, and the agent asks for a structured response or high reasoning effort. A provider tells its default through ModelOutputLimit, returned from the chat client’s GetService; the Anthropic provider does.

• ModelProviderSettingsContract.InvalidSettingValue and the scenario A_supported_setting_with_an_invalid_value_is_rejected: a provider that declares a key with a closed set of values proves that a wrong value is rejected and named. It is skipped when the property is left null.

• A workflow function node can report what it spent beyond tokens. The new extension IWorkflowContext.ReportUsageAsync(ToolCallUsage) (in Tracon.Workflows) records one item: a text-to-speech character, a render second, a minute of audio. It returns ValueTask<bool> and does not throw except for a null argument; it returns false outside a Tracon workflow run, for an invalid item (an empty Unit, a negative quantity or amount, or a value beyond what its column holds: a unit of 64 characters, a currency of 16, a provider of 100, a model of 200, a quantity above 9,999,999,999, an amount above 1,000,000,000) and once the run holds 1,000 items. An item is written at once and is not cancelled with the run, so a cancelled or failed run keeps what its node had spent, and a retried node keeps the items of its failed attempts. The item names the node that reported it; a custom executor in a graph built in code reports with no node name. An item reported after the run closed (a node that outlived its timeout) stays in the run’s detail and does not change the total, the quota entry or the webhook.

• A run has a non-token cost, a total of its own beside the token cost. RunNonTokenCost (Amount, Currency, IsEstimated, UnsummedItemCount) is on RunRecord.NonTokenCost (the run itself) and RunRecord.TreeNonTokenCost (the run and every run below it, the run counted once), and RunCompletion.NonTokenCost carries it to the store when a run closes. null means the run reported nothing, which is not zero; an Amount of null with a positive UnsummedItemCount means items were reported and none could be priced. One rule decides what adds: an item adds only when it has an amount in Tracon:Pricing:Currency (an item with no currency label is in it). Items with no amount, or in another currency, are listed and counted in UnsummedItemCount, never added or converted, and a quantity is never added across units. An estimated item adds and raises IsEstimated. Tracon never prices a node’s work: the node reports the amount it computed. RunSpend.Total(RunCost?, RunNonTokenCost?) and RunSpend.Total(RunTreeCost?, RunNonTokenCost?) are the one place the token cost and the reported amount are added; amounts in two currencies are never added.

• ToolCallUsage.Provider and ToolCallUsage.Model, names for the reader of the record that take no part in a total. The built-in speak, transcribe and generate_image tools fill them. A tool still reports with TraconToolUsage.Report, and its measurement now also joins the run’s non-token total the moment the tool reports it.

• GET /api/runs/{runId}/usage (Reader role, runs:read scope) lists the items a run’s function nodes reported, in the order reported. It lists the run’s own items, not its children’s; a tool’s measurement stays on GET /api/runs/{runId}/tools. An unknown run, another tenant’s run and a denied run all answer the same 404. GET /api/runs and GET /api/runs/{runId} carry nonTokenCost and treeNonTokenCost. All of it is new in the OpenAPI document and both generated clients (TraconListRunNonTokenUsageAsync, RunNonTokenCost, NonTokenUsageRecord).

• NonTokenUsageRecord and the IRunStore members RecordNonTokenUsageAsync and ListNonTokenUsageAsync. Three migrations add a run_non_token_usage table (its rows are deleted with their run), four snapshot columns on runs (non_token_cost, non_token_currency, non_token_estimated, non_token_unsummed) and usage_provider and usage_model on tool_invocations: PostgreSQL 0058, SQL Server 0046 and SQLite 0045. Existing rows keep NULL: nobody reported a number for them.

• The console shows a tool call’s measurement (quantity and unit, the amount or “unpriced”, “estimated”, provider and model) and, for a run that reported anything, a “Non-token usage” panel ending in “Reported in this run”, “Reported in the whole tree” and “N not added”.

• The tracon.recording.stage tag has a new value, non_token_usage: an item a function node reported could not be recorded. Alert rules that list the stages need it.

• Tracon.Testing.Contracts.Xunit: NonTokenUsageContract, and new scenarios in RunStoreContract and ToolInvocationContract for the snapshot, the tree total and a measurement’s provider and model.

• A stored workflow keeps its version history. Every save appends a version and a rollback appends the old content as a new one; nothing is rewritten. GET /api/workflows/{name}/versions (Reader) lists the full snapshots, newest first, GET /api/workflows/{name}/versions/{a}/diff/{b} returns two of them as left and right, and POST /api/workflows/{name}/rollback (Admin, body WorkflowRollbackRequest) rolls back. A rollback is judged like a save: a version that names a function that is no longer registered, settings that no longer fit, or an agent version that no longer exists answers 400 and writes nothing. An unknown version is 404, a workflow defined in code is 409 (its versions read 404). The audit trail records workflow.rollback with the version it came from and the one it wrote. A version number is never reused: deleting a workflow keeps its history and a workflow saved again under the same name continues the numbering. New in the OpenAPI document and both generated clients (TraconListWorkflowVersionsAsync, TraconGetWorkflowVersionDiffAsync, TraconRollbackWorkflowAsync, WorkflowVersionDiffResponse, WorkflowRollbackRequest).

• IWorkflowDefinitionStore.GetVersionAsync, ListVersionsAsync and RollbackAsync. Three migrations add the workflow_definition_versions table (no foreign key to workflows): PostgreSQL 0059, SQL Server 0047 and SQLite 0046. Each stored workflow starts its history at the version it has today; the versions it had before were never kept. A save writes the current row and its history entry in one transaction.

• A workflow run’s row records the version of the definition it was compiled from (RunRecord.AgentVersion of the workflow’s root row; null for a workflow defined in code and for a row written before this release). A resume or a response is stamped with the version it ran.

• definitionVersion on POST /api/workflows/runs/{runId}/resume and .../respond (WorkflowResumeHttpRequest.DefinitionVersion, WorkflowRespondHttpRequest.DefinitionVersion, WorkflowResumeRequest.DefinitionVersion, WorkflowRespondRequest.DefinitionVersion) names the stored version to continue with. A version the workflow does not have is 400 before a stream opens or a job is queued, and throws before any run row is opened when the engine is called directly; a run is never continued with the current definition in its place. A queued resume and a queued response carry it.

• WorkflowNodeReference.AgentVersion pins an agent step to one version of that agent. The step runs that version’s instructions, model and tools while the agent is edited, and its child run row records the version. Only an agent node in the nodes form can pin; a function node, a value below 1, an agent defined in code and a version the agent does not have are refused with 400 when the workflow is saved and when it is compiled. The pin is not part of the step’s identity, so changing it does not make a waiting run’s checkpoint unusable. The agent’s own sub-agents and skills still resolve their current version.

• The console lists a workflow’s versions, compares two of them and rolls back, and an agent step in the chain editor can pin a version of a stored agent.

• Tracon.Testing.Contracts.Xunit: new scenarios in WorkflowDefinitionStoreContract for the history, the numbering after a delete, rollback, concurrent saves, tenant isolation, a pin’s round trip and cancellation, and the optional SupportsRawHistory, ExecuteRawAsync, QualifiedWorkflowHistoryTable and RawNowExpression hooks a SQL provider overrides to prove that a failed history write leaves the current definition as it was.

Changed

• The agent step of a workflow, in a stored chain and in a graph built in code, now asks the agent for its whole answer instead of a stream. The step never forwarded a delta to the workflow’s feed, so the stream bought nothing, and the streaming path has no structured-response repair. Behavior change: a step whose model answers JSON that does not fit the agent’s schema is asked again up to Tracon:StructuredResponse:MaxRepairAttempts (before, the broken answer reached the next node), and the step’s own runs row has IsStreaming = false and a message.completed event beside the message.delta it already had. Its tokens, cost and input are recorded as before. A loop agent still hands the next node its final iteration only.

• A workflow function node no longer starts once the call tree’s cost or time budget is spent. Until now the budget refused a model call and a new agent step but let a function node run and do its paid work (speech, a render, a GPU minute), and a chain of function nodes only never stopped at all. Behavior change: with Tracon:AgentGraph:MaxTotalCost or Tracon:AgentGraph:MaxDuration set, the next function node does not start once the tree has passed either; the run ends Failed with run_budget_exceeded (class QuotaExceeded), the message names the node and the setting to raise, and no later node runs. Each attempt of a retried node is checked, and the refusal is never retried, whatever the registered IRunErrorClassifier says. MaxTotalTokens does not stop a node (it is on by default and a function node spends no tokens), and a host that sets neither ceiling is not affected. A node that is already running is never stopped, so a tree can pass its ceiling by as much as its last node spends. A node that spends nothing and has to run afterwards, such as a step that stores what the budget has just paid for, sets the new WorkflowFunctionOptions.StartsWhenBudgetIsSpent to true in its registration; an operator cannot set it in a definition. A run built in code with AddWorkflow and its own executors is not gated: read TraconRunContext.Current?.Budget there.

• POST /api/workflows/runs/{runId}/respond changes in the default Branch mode too. The run an answer starts now has its row opened (Running for a streamed answer, Queued for a queued one) before the answer is recorded and before the stream starts, and the answer’s record is written before the run is handed over. Behavior change: when the record cannot be written (workflow_responses unavailable), the answer is refused with 500 and the opened run is closed Failed with the error type answer_not_recorded and no events; before, the answer was not recorded at all. A run store that cannot open the row refuses the streamed answer with 500 too; before, the engine’s run writer logged that failure and the run went on unrecorded. Every run an answer starts now carries WorkflowResponseApplied at sequence 1, so its later events are numbered one higher than before.

• Behavior change: the in-memory job store (the default IJobStore) refuses a job whose id is already queued, as the PostgreSQL, SQL Server and SQLite stores’ primary key does; before, it replaced the queued job, which could set a leased job back to Pending. The IJobStore.EnqueueAsync documentation now states the refusal, and JobStoreContract checks it with a new case. A queued run whose enqueue is refused because its job is already there (another call wrote it) is no longer closed as Failed; the call answers with the job that is there.

• AddWorkflow(builder, name, factory, string? description = null) is now two overloads, AddWorkflow(builder, name, factory) and AddWorkflow(builder, name, factory, string? description), beside the new one that takes Action<WorkflowRegistrationOptions>. Every call compiles as before except one that passes a literal null as the third argument, which is now ambiguous; leave the argument out instead.

• Behavior change: a configuration entry Tracon cannot read now stops the application at startup instead of being dropped without a word. Four settings change:

  • Tracon:Quotas:ThresholdPercents and Tracon:Webhooks:RetryDelays: an entry that is not a number (a TimeSpan for the delays), or that is zero or below, was skipped, so the list came out shorter than written. It now fails startup and the message names the key and quotes the entry (ThresholdPercents[1] is '9O').
  • Tracon:ContentProtection:Columns: an entry that is not one ProtectedColumn name — a misspelling, an empty entry, an undefined number, or two names joined by a comma, which was read as a third column — was skipped, and the column you meant stayed in plain text. It now fails startup and the message quotes the entry.
  • Tracon:ContentProtection:Keys: an entry with an empty configuration key name was skipped. It now fails startup and the message names the key id.
  • Tracon:ContentGuard:Pattern:MaskedPii: one misspelled name ("Emial,CreditCard") turned PII masking off for the whole list, and a number with an undefined bit was accepted. It now fails startup and the message quotes the value. An empty value still means no pattern.

  The Columns and Keys checks run while content protection is off too: an old encrypted row is still read through Keys. A value that code sets for the same member after binding replaces the configured one and clears the error. An undefined ProtectedColumn or PiiPatterns value set in code (for example options.MaskedPii = (PiiPatterns)64 in AddPatternContentGuard) now fails startup as well.

• Behavior change: a workflow run that waits to be resumed keeps the definition version it recorded. Before, resume and respond compiled the current definition: an edit made while the run waited changed its settings, timeouts and parameter schema without notice, and a structural edit (a step added, removed or reordered, the pattern or the stored form changed) made the run impossible to resume. Now such an edit changes nothing for that run. To carry a run over a fix, name the edited version in definitionVersion; a version whose graph differs from the checkpoint’s fails the run with “the graph’s structure differs”, as before. A run whose row recorded no version (written before this release) resumes with the current definition, and a resume of a workflow that was deleted is still refused.

• Breaking for implementers (preview): IWorkflowDefinitionStore has three more members (GetVersionAsync, ListVersionsAsync, RollbackAsync). A store of your own has to keep the history; a default implementation would have dropped every pinned step the first time the workflow was edited. The in-memory store and the three SQL stores implement them, and WorkflowDefinitionStoreContract runs against yours.

• The console writes the nodes form of a chain when it has a function node or a pinned agent step (it was: a function node). A chain of agents alone with no pin is still saved as agentNames. Pinning the first step of such a chain changes the stored form, which is a graph change: the editor warns, and a run that waits keeps resuming the version it recorded.

• Behavior change: skill script results read differently. A timed-out script now reports The script timed out and was stopped. (was … and the process tree was terminated.); a script whose executor did not return within Timeout plus five seconds reports that it may still be running, and its tool call error is Timed out; the script executor did not return in time. The truncation notice is now one line at the end of the result, [Tracon: output truncated at the N-byte limit per stream.], added only by the runner, which also caps each stream again. An executor that throws fails the call with only the exception type in the tool call record and the model’s view; the message goes to the server log.

• Behavior change: TraconSkillScriptOptions.MaxScriptContentLength now limits a script file under SkillRoots too. A file larger than the limit, an empty file, or anything that is not a regular file (a FIFO, a link to a device) is refused from its metadata before it is opened and is written to the audit trail as script.denied. Before, a FIFO blocked the call while it held a concurrency slot, and a link to /dev/zero was read without end. A stored script whose name is not a plain file name is now refused the same way, before the script.run entry.

• Behavior change: TraconSkillScriptOptions.Timeout accepts at most about 49.7 days minus five seconds; a larger value fails at startup, because the runner’s wait limit adds five seconds to it.

• Tracon.Testing.Contracts.Xunit: ModelProviderSettingsContract’s invalid-value case now also fails when the refusal message repeats a text InvalidSettingValue. Behavior change: a provider that echoes the rejected value fails the case; name the key and the accepted values instead.

• ISpeechProviderResolver gains GetDialogueSynthesizerAsync. The member has no default implementation: a resolver of your own must implement the dialogue gate.

• Behavior change: POST /api/jobs/{id}/cancel now reaches a running handler. The worker reads each running job’s status every Tracon:Scheduling:PollInterval and cancels the handler’s token when it finds the job cancelled or gone; before, a running job ran on until its handler called JobContext.IsCancelledAsync. This costs one store read per running job per poll interval. A job cancelled this way stays Cancelled.

• Source break: builder.AddWorkflowFunction<TInput, TOutput>(name, factory, null) no longer compiles (CS0121): a null third argument fits both the description parameter and the new Action<WorkflowFunctionOptions> overload. Name the argument (description: null) or leave it out.

• The generated C# client TraconApiClient changes three method signatures. TraconListRunsAsync gains a continuedFromRunId parameter before skip and take, TraconVoiceListAsync gains a provider parameter and TraconEraseDataSubjectAsync a force parameter before the cancellation token. The new parameters are optional, so a call that names its arguments compiles unchanged. A call that passes skip, take or the cancellation token by position no longer compiles; name the argument. Code compiled against the previous package must be rebuilt.

• Behavior change: the streamed workflow endpoints now check their input before the stream opens. POST /api/workflows/{name}/run with an invalid sessionId, resume of an unknown run or checkpoint, and respond to a run that does not wait for input answered 200 and reported the error inside the event stream; an unknown checkpoint also opened a new Failed run row. They now answer 400 (invalid session id, unknown checkpoint, a run that does not wait) or 404 (unknown run, or a run of another tenant) as problem details, and open no run.

• Behavior change: the names functions (workflows) and handler-keys (schedules) are reserved. GET /api/workflows/functions and GET /api/schedules/handler-keys are matched before {name}, so a definition saved under one of these names could never be read back. Saving one now answers 400, and AddWorkflow throws ArgumentException. The check ignores case.

• The console’s tenant provider panel offers speech providers next to the model providers, by the provider name a policy and a binding use. A name saved in a policy that no provider reports any more stays listed and can be removed; before, it was invisible and sent back on every save.

• IWorkflowFunctionCatalog gains ValidateSettings(string name, JsonElement? settings), which returns a message that names the function and the problem, or null. An implementation of the interface outside Tracon must add it; the registry AddWorkflowFunction builds is the only implementation Tracon ships.

• Tracon.Testing.Contracts.Xunit adds two WorkflowDefinitionStoreContract cases: a function node’s Settings survive the round trip, and saving the definition again without them clears them. A custom IWorkflowDefinitionStore that rebuilds a node from its own columns and drops the field now fails them.

• The generated C# client documents the 41 nullable object properties whose description was lost on the way from the OpenAPI document (for example AgentDefinition.Harness).

• Every endpoint that starts a run now refuses an attribution that breaks a label limit with 400 before the run starts, as the agent run endpoint already did: workflow run, resume and respond, run replay, the inbound trigger endpoint, and /v1/chat/completions and /v1/responses (in the OpenAI error shape, type: invalid_run_attribution). These endpoints started the run with no user and no labels, and answered 200.

• A run that spends tokens on more than one model (a compaction summarizer or an aiJudge judge on a model other than the agent’s) prices each model’s share at that model’s price, and cost is the sum. The three *PricePerMillionTokens fields of such a run are null: one rate cannot describe the total. A model with no price adds nothing to the cost and is not priced at the agent’s rate. The cost is Unknown only when no model of the run has a price. POST /api/stats/recalculate-costs does not re-price such a run when any of its models had a price. A run whose summarizer or judge runs on the agent’s own model is unchanged.

• UseVoice() and UseOpenAILive() now validate their settings when the application starts. Both validators already said so, but neither registration asked for it, so an invalid value — a missing ElevenLabs key, a headerless OutputFormat, a zero MaxAppendCharacters, a missing OpenAI key — surfaced at the first voice request or live session. A host registered with such a value now fails at startup, and the message names the setting.

• The OpenAI provider now rejects every ModelBinding.ProviderSettings key, as Azure OpenAI already did. The rule covers openai, openai-responses and every UseOpenAICompatible() registration; their settings prefix is openai (OpenAIProviderNames.SettingsPrefix) and OpenAIProviderNames.SupportedSettings is empty. Before, the provider never read the dictionary, so a key, for example anthropic.promptCaching left over after a switch from Anthropic, was ignored silently: the agent saved and ran without the behavior its author wrote. Now POST /api/agents/validate reports invalid_setting at model.providerSettings, saving the definition returns 400, and a stored or code-defined agent with such a key fails compilation. Remove the key with PUT /api/agents/{name} or in code. The console does not edit providerSettings and keeps the stored value, so a console save of such an agent fails until the key is removed through the API.

• ModelProviderSettingsContract.SupportedSetting (Tracon.Testing.Contracts.Xunit) is now virtual and returns KeyValuePair<string, JsonElement>?, default null. Derive the contract for every provider; a provider that supports no key leaves it null, and the two scenarios that need an accepted key report as skipped. An existing override fails with CS0508; add ? to its return type.

• A harness agent no longer gets the provider’s hosted web search by default. Set HarnessSettings.EnableWebSearch to turn it on; the search runs at the provider and is billed by it, and the Chat Completions surface accepts it only for search models. A definition that sets both EnableWebSearch and DisableWebSearch is refused when it is compiled. The console’s harness section shows “Enable web search” in place of “Disable web search”.

• A failed workflow run’s error.type is the same stable identity an agent run records - loop_unsatisfied, run_budget_exceeded, upstream_error - instead of the exception’s CLR name, and the run now carries an error class and fingerprint. A consumer that matched a CLR name such as Tracon.TraconLoopUnsatisfiedException on a workflow row matches the identity instead.

• A non-streaming harness loop returns the final iteration’s answer; its usage stays the sum of every iteration. A streaming loop still streams every iteration. Each iteration remains on the run as a LoopIterationCompleted event.

• A code workflow built with GetWorkflowAgent fails at a step that cannot answer, as the defined workflows do (see Fixed).

• A job’s lease is renewed at a third of Scheduling:LeaseDuration instead of half, so the longest accepted lease is about 149 days.

• IAgentDecorator.Decorate receives the descriptor of the definition version the agent was compiled from - the pinned version on a pinned resolve.

• Tracon.Testing.Contracts.Xunit adds two JobStoreContract cases: CompleteAsync and ReleaseForRetryAsync leave a cancelled or finished job unchanged. A custom IJobStore that overwrites a final status now fails them.

• CompiledAgentCache holds one entry per tenant, agent name, definition and culture. A compile under a new dependency fingerprint (skills, egress policy, MCP tool bindings) replaces the entry instead of adding one, so the cache no longer grows when a remote server edits its tools; Count counts these entries.

• The AddGeneratedTools() extension that the [TraconTool] generator writes into your assembly is now internal. It was public, so a host that referenced a class library with tools saw the library’s copy next to its own, and AddGeneratedTools() failed with CS0121 (or with TRC0005 in a host without tools). A library hands its tools to a host through its own public extension that calls AddGeneratedTools() from inside; a host that called a library’s generated extension directly calls that library extension instead. The TRC0005 message now says so.

• Tracon.Testing.Contracts.Xunit adds two ToolApprovalRuleStoreContract cases: SourceFingerprint round-trips, and two rules that differ only in it are two rules. A custom IToolApprovalRuleStore that drops the field or leaves it out of the rule’s identity now fails them.

• Tracon.Testing.Contracts.Xunit adds three store contract cases. ExperimentStoreContract requires that SaveAsync keep the canary policy of a draft and never write one itself. WebhookStoreContract requires that SaveSubscriptionAsync write the failure count the subscription carries. A custom store that does otherwise now fails them.

• A replay, an automatic continuation and a resume after a tool approval no longer refuse an agent that declares parameters. They bind the values the source run recorded (a replay request can change some of them) and refuse a source that recorded none. Before, they refused every such agent. If you upgrade with an approval pending on a queued run of a parameterized agent that predates parameter recording, the decision cannot be applied and says so.

• The batch item rule changed: an item that is a JSON object with a string message member is now read as a structured item instead of as plain text. A text item whose content is such an object is the one ambiguity; the stored item keeps no type. A malformed structured item fails alone, and the schedule endpoints refuse it when it is saved or triggered. A schedule you saved before this release that holds such an item with a member the shape does not name ({"message": "...", "user": "bob"}) is not checked again; its item fails on the next run instead of running as text.

• An inbound trigger that targets a workflow now stores the sender’s text as {"message": "<text>"}. The body of a webhook is not yours: read as a batch item, a body such as {"message": "...", "parameters": {...}} would have let the sender choose the workflow’s parameter values. The job item’s input shows the wrapped text, and the run still gets the body as its message.

• Online evaluation and POST /api/runs/{id}/judge skip a run whose recorded input has no messages, as they skip a run with no recorded input. A workflow run that declares parameters now has such a row (it holds the values).

• GET /api/runs/{id}/input answers 200 with an empty message list for a workflow run that recorded parameters; it answered 404 before. The values are not returned there. A replay of a workflow run answers 400 and points to resume.

• POST /api/agents/validate reports every loop problem with its own code (loop_criteria_empty, loop_max_iterations_invalid, loop_outcome_invalid, loop_criterion_kind_missing, loop_criterion_unknown, loop_marker_missing, loop_judge_criteria_missing, loop_judge_unconfigured, loop_judge_unavailable) and the field’s path, for example harness.loop.criteria[1].marker. Before, it reported the first loop problem only, as a path-less compilation_error. Saving such a definition returns 400 with every loop message, and a compile error lists them all.

• An aiJudge loop criterion with a blank entry in judgeCriteria is now refused, with loop_judge_criteria_missing at the entry’s path (harness.loop.criteria[i].judgeCriteria[j]). Before, such a definition compiled, and the judge received a criterion with no text to check. Remove the blank entries; the console drops them when you leave the field.

• A structured response cut off at the output limit no longer completes with a partial JSON document (validation off) or fails as StructuredResponseInvalid after spending every repair turn on the same limit (validation on); it fails once as OutputTruncated. A dashboard or alert rule that counted these runs under StructuredResponseInvalid needs the new class.

• Online evaluation does not retry a judge whose model answer was cut off at the output limit. The item fails with judge_failed on the first attempt, as for a permanent 4xx; before, the job sent the same request with the same limit until its attempts ran out. Raise the judge binding’s MaxOutputTokens.

• Source break: IRunStore gains two members, RecordNonTokenUsageAsync(NonTokenUsageRecord, CancellationToken) and ListNonTokenUsageAsync(Guid, CancellationToken). They have no default implementation, so a custom IRunStore does not compile until it adds both. A store must also keep RunCompletion.NonTokenCost on the run and return it, with the tree total, as RunRecord.NonTokenCost and TreeNonTokenCost. Derive the new NonTokenUsageContract beside RunStoreContract to prove it. The shipped stores implement both members; only a store of your own needs the change.

• Behavior change: WebhookRunSummary.Cost on run.completed and run.failed now means the token cost and the amount the run reported beyond tokens, together. It already said “the total amount”; a run that reported nothing sends the same number as before. The new WebhookRunSummary.NonTokenCost is the reported part, absent when nothing was reported, so the token part is Cost - NonTokenCost whenever both are in the same currency. When a tree’s token cost and its reported amount are priced in different currencies, Cost stays the token cost alone and NonTokenCost is still given. A consumer that read Cost as tokens only should subtract it.

• Behavior change: the amounts a run reported beyond tokens count against the tree budget (Tracon:AgentGraph:MaxTotalCost), a tenant’s cost quota and the cost in both webhooks. An amount that adds is recorded into the budget the moment it is reported, so the tree’s next model call is refused once the ceiling is passed, and the quota entry of an agent root and of a workflow root includes it. A tool’s measurement joins the same total. A run that reports nothing is unaffected. Still token-only on purpose: GET /api/stats, the dashboard, the tracon.run.cost metric, the comparison of two runs and the console’s Tools screen. A quota has no limit on a unit such as characters. The same ceiling also stops a function node from starting (see the entry that begins “A workflow function node no longer starts” at the top of this section).

1.0.0-preview.3 — 2026-09-24

The first security release. It closes the tenant-boundary and credential-exposure defects of the earlier previews listed under Security, and it changes the public API: every removed or changed type is named below. Read Security and Changed before you upgrade.

Security

Every change below except the audit trail one can refuse a request or a record that a running setup accepted before. Each refusal names what to change.

• A stored record may name only a configuration key inside its own tenant. The allowed prefix is one per installation, so a record of one tenant could name another tenant’s key and point it at an address it controls. A non-default tenant now names keys under {prefix}{tenant}: (for tenant acme, Tracon:McpSecrets:acme:GithubToken); a flat name directly under the prefix belongs to the default tenant, so a single-tenant installation changes nothing. The rule covers MCP servers, tenant provider bindings, webhook subscriptions and inbound triggers, where the record is saved (400) and where its value is resolved. Move an out-of-tenant name under the tenant’s segment.
• /api/tenants/{tenantId}/providers, /api/tenants/{tenantId}/egress and the tenant records (/api/tenants) act on a tenant other than the caller’s own only with platform authority: an API key that also carries PlatformAdmin, the static AuthToken, or — for a claims principal while multi-tenancy is on — the new TraconPolicies.PlatformAdmin policy. A missing registration of that policy denies (403). Before, a key bound to one tenant with SecurityAdmin, or a claims-based Admin of one tenant, could rewrite another tenant’s provider binding.
• With AllowRemoteAccess on and neither AuthToken nor an authorization policy configured, an anonymous remote request now returns 401; API keys keep working. A request that still carries X-Forwarded-For, Forwarded or X-Real-IP counts as remote, so a reverse proxy on the same machine no longer makes every caller look local. Without a token or a policy, an anonymous request with a non-loopback Host or Origin returns 403, which blocks DNS rebinding and cross-site requests; the voice WebSocket follows the same rule.
• Creating an API key that carries the PlatformAdmin scope now needs the same platform authority as acting on another tenant. Before, a claims-based Admin of one tenant, without the TraconPolicies.PlatformAdmin policy, could create such a key and use it to reach other tenants. An API key can still only create scopes it carries itself.
• GET /api/mcp-servers and the PUT /api/mcp-servers/{name} response no longer return stored extra header values: every header keeps its name and carries the value ***. Before, any Reader or AgentsRead API key could read a header value such as an API key and call the MCP server directly, past the tool approval gate. Webhook subscriptions (GET /api/webhooks, GET /api/webhooks/{name} and the PUT response) follow the same rule. The stored value does not change and is still sent to the target.
• The MCP server audit trail records header names only. The values of headers whose names the secret filter does not recognize, such as Cookie or Ocp-Apim-Subscription-Key, no longer enter the audit log as plain text.
• A script grant now pins the content it was given for. A stored script, and a script of a skill registered in code, runs only while its content still has the hash the grant carries; a change stops it until it is granted again. A grant without a script name pins the whole script set, so adding, removing or changing any script stops them all. An existing grant pins nothing and no longer authorizes a stored or code script: grant each one again. Read scripts[].contentHash or scriptSetHash from GET /api/skills/{name} and send it as expectedContentHash to POST /api/skill-script-grants (missing or malformed 400, unknown script 404, changed content 409). Scripts read from disk are not pinned and keep working; keep their directories read-only. Before, an administrator who could write skills could replace a script’s content after a security administrator had approved it, and the old grant kept authorizing the new code.
• In a multi-tenant host, granting a stored script needs platform authority (an API key that also carries PlatformAdmin, the static AuthToken, or the TraconPolicies.PlatformAdmin policy; 403 otherwise). The script runs under the server’s own operating-system identity and can read other tenants’ data, so the grant is an installation decision, not a tenant’s.
• A store of your own must keep SkillScriptGrant.ContentHash. A store that drops it fails the new SkillScriptGrantContract cases, and its grants refuse every stored script.
• A credential header of an MCP server or a webhook subscription is declared by configuration key name in the new headerConfigurationKeys, and a save whose plain headers carry a credential-looking name (Authorization, Cookie, a name containing api-key, token, password or secret, or a name ending in -key) returns 400. The detail names the header and the new field and never repeats the value. Before, Authorization was the only header with a key reference, and X-Api-Key or Ocp-Apim-Subscription-Key was stored in the database as plain text. A stored row keeps working and is still sent; each connection or delivery logs a warning that names the header. Every key name follows the prefix and tenant rules above, on save (400) and again before each connection or delivery: an MCP server whose map names another tenant’s key does not connect, and such a webhook delivery is dropped.
• A header name may appear only once across headers and headerConfigurationKeys, compared without regard to case, and must be a valid HTTP field name (400 otherwise). Turning OAuth on for an MCP server whose kept plain headers still carry Authorization returns 400: the MCP client skips its bearer token while that header is present. A webhook’s two maps together may carry at most Tracon:Webhooks:MaxExtraHeaders entries (400 instead of being cut at delivery), and headerConfigurationKeys may not name an X-Tracon-* header.
• PUT /api/mcp-servers/{name} and PUT /api/webhooks/{name} keep a stored header map when the request leaves it out or sends null; {} removes it. Saving from the admin UI therefore keeps the headers. The side effect: a save that changes only the address sends the kept headers, and the credential values they resolve, to the new address; the server logs a warning with the header names. Send the maps, or {}, in the same save when an address moves.
• An OperationCanceledException that an IRunAuthorizationHandler throws, but that the request itself did not cause (for example, an HttpClient timeout inside the handler), is now a failed check. A single resource answers the same 404 as a missing one. Before, it answered 500, which revealed that the resource exists.

Added

• HeaderConfigurationKeys on McpServerDefinition, McpServerRequest, WebhookSubscription and WebhookSaveRequest: a map from a header name to the configuration key its value is read from. The value is resolved on each connection or delivery and never stored; a response returns the map as stored. The mcp_servers and webhook_subscriptions tables gain a header_configuration_keys column (migration 0054 PostgreSQL, 0042 SQL Server, 0041 SQLite); existing rows read an empty map.
• McpServerStoreContract.Header_configuration_keys_are_preserved, WebhookStoreContract.Header_configuration_keys_are_preserved and WebhookStoreContract.Header_names_that_differ_only_in_case_do_not_fail_the_save. A store of your own must persist the new field and return it from the save as well as from a read.

Fixed

• Tracon.UI now carries the notices of the third-party code in its embedded console: React, React DOM, scheduler, TanStack Query, openapi-fetch, and Tailwind CSS, all MIT. THIRD-PARTY-NOTICES.txt ships at the package root and inside Tracon.UI.dll. Before, the package redistributed that code without them.
• A webhook subscription whose headers differ only in case (X-A and x-a) no longer fails the SQL save with 500, and such an MCP server no longer fails to connect.
• The MCP OAuth authorization flow now sends the same headers as every other connection to the server, including the ones resolved from configuration.
• A header that the MCP transport cannot add (a content header such as Content-Type, or a value with a line break) is left out with a warning. Before, the transport’s exception carried the header value into the log.
• The TRC0201 analyzer names the header for a literal secret in a header dictionary (McpServerDefinition.Headers["X-Api-Key"]) and points at HeaderConfigurationKeys.
• A slow or unresponsive database no longer blocks the metrics collection thread while the quota or queue-depth gauge refreshes. Before, this delayed the export of every other instrument of the meter provider.
• The quota threshold notification cache in QuotaEnforcer no longer grows for the life of the process. Entries of closed quota periods are now dropped.
• A failed or cancelled durable threshold claim no longer keeps a quota threshold notification silent until the end of the period. The next run in the same period retries the claim.
• The quota admission check, the threshold accounting, the quota gauge and GET /api/quotas/usage now read only the counters of the current periods. Before, every read returned the tenant’s whole usage history, twice per run, and that history only grows.
• GET /api/models/health no longer fails for every provider when one provider’s health check throws. The failing provider is reported Unhealthy with the exception type in detail (The health check failed (...)), and the exception is logged at Warning level. The background health refresh also continues past that provider.
• An Azure OpenAI CredentialFactory credential that throws while it gets a token (for example DefaultAzureCredential without an Azure sign-in) now reports Unhealthy with Credential error (<exception type>) and logs the exception, instead of escaping the health check.
• UseAzureOpenAI(IConfiguration) now binds a relative Endpoint and a Models entry without a Name, so start-up validation rejects them with the specific message, the same as the other three providers. Before, a relative endpoint was reported as missing and a nameless entry was silently dropped. An application that relied on the silent drop now fails at start-up.
• The out-of-catalog log entry of an UseOpenAICompatible() provider now names OpenAIProviderOptions.Models instead of the Tracon:Providers:OpenAI section, which that provider does not read.
• Two approval rules whose argument conditions differ are no longer merged into one by the SQL stores when a condition path carries the U+001E or U+001F control character. Before, saving the second rule returned the first one unchanged. Existing rules keep their stored fingerprint; no migration runs.
• The in-memory approval rule store now treats a list value that differs only in whitespace (["eu", "us"] and ["eu","us"]) as the same condition, the same as the SQL stores. Before, it kept two rules.

Removed

These public types are now internal. None is part of a seam you implement or a call you make: the same behavior is reached through the public registration methods, options, and interfaces. The API is not frozen in the preview line, and the counts below are types, not members.

• Tracon.PostgreSql, Tracon.SqlServer, Tracon.Sqlite: MigrationRunner. It existed once in each provider package under the same name, so an application that referenced two providers could not name it (CS0433). Resolve IMigrationApplier to apply migrations and ISqlPersistenceDiagnostics for the migration snapshot; both resolve to the same runner. The tracon migrate command is unchanged.

• Tracon.Anthropic, Tracon.Azure, Tracon.Google, Tracon.OpenAI: AnthropicChatClientFactory, AnthropicModelCatalog, AzureOpenAIChatClientFactory, AzureOpenAIModelCatalog, GoogleChatClientFactory, GoogleModelCatalog, OpenAIChatClientFactory, OpenAIModelCatalog, and OpenAIApiSurface. The Use* registration methods and the *ProviderOptions types are the configuration surface; a factory created through FromClient could not be plugged into a registered provider anyway.

• Tracon.Abstractions (11): ChatHistoryState, ExperimentAssignment, JobPayload, ReplayToolMismatchException, RunAttributionReader, SafeErrorText, SchemaReadyGate, ToolArgumentConditionLimits, TraconSessionStateKeys, WebhookEventPayloadJsonContext, and WorkflowCheckpointState. A store’s checkpoint listing still returns an empty JSON object ({}) as State; the documentation of IWorkflowCheckpointStore now says so.

• Tracon.Core (69): AgentCallGraph, AgentCallGraphProblem, AgentSessionIdentity, AttachmentTypeGuard, AttachmentUriReference, AttachmentValidationResult, AuditActorContext, AuditChainHasher, AuditChainWalker, AuditPayload, AuditRecorder, AuditSecretFilter, AuthorizingAIFunction, CanaryEvaluator, ChildRunApproval, CodeAgentRegistration, ConfigurationKeyGuard, CronExpression, DefaultProviderRetryClassifier, DocumentAttachmentSummary, DocumentChannelMessageBuilder, EgressAddressPolicy, EgressAddressValidator, EgressAddressVerdict, EgressSocketGuard, InMemoryWorkflowCheckpointStore, InboundTriggerDispatchResult, InboundTriggerOutcome, InboundTriggerRateLimiter, InboundTriggerSecretResolver, InboundTriggerValidatedRequest, InboundTriggerValidationResult, InstructionCultureResolver, InstructionParameterBinder, OnlineEvalSummaryService, ProviderCredentialClientCache, QuotaPeriodCalculator, ResolvedRetentionPolicy, RetentionExecutor, RetentionPolicyResolver, RunPromotionOutcome, RunPromotionStatus, RunReplayOutcome, RunReplayPreparation, SessionBranchOutcome, SessionBranchStatus, SkillScriptExecutionResult, SkillScriptNaming, StateGenerationCount, StatePreflight, StatePreflightReport, StateSampleFailure, TextChunker, TextTrimming, ToolApprovalPolicyRegistration, ToolApprovalPolicyRegistry, ToolApprovalRuleEvaluator, TraconEvalCheckRegistration, TruncatingAIFunction, ValidatingAIFunction, VoiceAudioFormats, VoiceConnectionLease, VoiceConnectionLimiter, VoiceConversationProtocol, VoiceConversationRequest, WebhookHttpClient, WebhookUrlValidator, WebhookUrlVerdict, WorkflowDefinitionValidator.

• Tracon.Voice: VoiceProviderNames. The provider value stays the plain string elevenlabs.

• Tracon.Abstractions (3 more): QuotaDecision, QuotaThresholdCrossing, and SqlPersistenceRegistrationMarker. Only the SQL provider packages register the marker; a marker registered by other code made background services and approval requests wait for a migration that never ran.

• Tracon.Core (16 more): AgentSkillCatalog, CallableAgentResolver, ContentGuardPipeline, ModelProviderCircuitBreaker, ModelProviderHealthCache, ProviderConcurrencyLimiter, QuotaEnforcer, RunSampleRequest, RunSampler, RunTraceCollector, SandboxedSkillScriptRunner, SkillScriptSupport, TenantProviderCredentialResolver, ToolApprovalPresenterRunner, TraconLoopEvaluatorRegistration, and TraconMetrics. Metrics stay available through the TraconDiagnostics.MeterName meter, loop evaluators through AddLoopEvaluator, and quotas through TraconQuotaOptions and the quota endpoints.

• The public constructors of the service types that the container or the run pipeline builds are now internal: RunRecordingAgent, AgentDefinitionCompiler, TraconDiagnosticsCollector, ModelProviderRegistry, SandboxedSkillScriptRunner, ChildAgentInvoker, ContentGuardPipeline, RunEventWriter, AgentSessionManager, QuotaEnforcer, ModelProviderHealthCache, RunSampler, SkillScriptSupport, ModelProviderCircuitBreaker, and TraconMetrics. Each took optional parameters, so a new dependency after 1.0.0 would have needed one more overload. Resolve the service that AddTracon() registers:

  // Before (1.0.0-preview.1 / preview.2)
  var registry = new ModelProviderRegistry([provider]);
  
  // After: resolve the service Tracon registers
  var services = new ServiceCollection();
  services.AddTracon().AddModelProvider(provider);
  using var serviceProvider = services.BuildServiceProvider();
  var registry = serviceProvider.GetRequiredService<IModelProviderRegistry>();

  RunRecordingAgent wraps every agent that IAgentCatalog.ResolveAsync returns, and ChildAgentInvoker wraps each callable agent of a compiled definition. The run writer’s lifecycle methods (RunEventWriter.StartAsync, RunEventWriter.CompleteAsync, RunEventWriter.RecordToolInvocationAsync and RunEventWriter.CompleteLateToolInvocationAsync) are now internal too: code inside a run reads the writer from TraconRunContext.Current and keeps AppendAsync and the read-only properties.

Changed

• Tracon.AspNetCore now depends on exact versions of its five pre-release packages: Microsoft.Agents.AI.Hosting, .Hosting.A2A, .Hosting.AspNetCore, .Hosting.OpenAI, and A2A.AspNetCore. Before, each was a lower bound, so a newer Hosting preview restored without a warning and failed at run time: in 1.22.0-preview, Microsoft.Agents.AI.Hosting.AgentSessionStore moved out of the Hosting assembly (TypeLoadException). A direct reference to another version now reports NU1608 at restore, and a transitive one NU1107. Move to a newer Hosting preview together with the Tracon release built against it.

• TraconToolRegistration takes only the tool in its constructor. Every other setting is an init property with the same default as before, so a setting added later does not change the constructor again:

  // Before (1.0.0-preview.1 / preview.2)
  new TraconToolRegistration(fn, requiresApproval: true, maxOutputBytes: 4096);
  
  // After
  new TraconToolRegistration(fn) { RequiresApproval = true, MaxOutputBytes = 4096 };

  The old named arguments fail to compile with CS1739, which names the argument. AddTool and AddScopedTool with ToolRegistrationOptions do not change.

• ITraconBuilder now declares only Services. Its 27 registration methods (Configure, AddTool, AddScopedTool, AddToolsFrom, AddAgent, AddSkill, AddAgentSource, AddAgentDecorator, AddRunJudge, AddModelProvider, AddEvalCheck, AddLoopEvaluator, RequireCustomBinding and RequireProductionProfile) are extension methods on the new TraconBuilderExtensions class, in the Tracon namespace next to AddTracon(). A new registration method therefore never changes the interface. Calling code does not change; using Tracon; is enough.

  • An assembly compiled against an earlier 1.0.0-preview.N release (1.0.0-preview.1, 1.0.0-preview.2) that creates a TraconToolRegistration or calls an ITraconBuilder method throws MissingMethodException until it is compiled again. This includes the code the [TraconTool] source generator wrote into your assembly: the exception comes from the AddGeneratedTools() call.
  • Upgrade every Tracon package together. A provider, MCP, Voice or Testing package from an earlier preview next to the new Tracon.Core fails while it registers, for example with MissingMethodException inside UseOpenAI(), before the start-up version check can run.
  • An ITraconBuilder implementation of your own needs only Services. An explicit implementation of a removed method (ITraconBuilder ITraconBuilder.AddTool(...)) fails to compile with CS0539; delete it. A public method with the same name still compiles, but it runs only when the caller holds your concrete type. Through ITraconBuilder, Tracon’s extension method runs and writes to your Services, so a test double must return a real service collection from it.
  • Every registration method now throws ArgumentNullException for a null chain (NullReferenceException before).
  • An extension method of your own with the same signature as one of these no longer loses to the interface member. Declared in a namespace nearer to the call than Tracon (for example in your own namespace MyApp), it now runs instead of Tracon’s method, with no warning. Imported at the same level as Tracon, the call is ambiguous (CS0121). Rename or remove such an extension.

• Every Tracon package now depends on its Tracon siblings at exactly its own version ([1.0.0-preview.3]), not at that version or any later one. Upgrading one Tracon package and not the others now fails restore with NU1107, or warns NU1608 when your project references the shared package directly.

• A host whose loaded Tracon package assemblies come from more than one release no longer starts. It stops before any hosted service starts, with a TraconException that lists each Tracon assembly and its version. Before, it started and failed later, at the first call into a member the other release no longer has. Every Tracon library package is compared except Tracon.Client, which talks to a server over HTTP and may call another release by design. The check has no setting to turn it off. A process that never starts a host (a bare BuildServiceProvider(), or a test project that runs the store contracts) does not run it.

• A project created with dotnet new tracon-api treats NU1608 as an error, so such a graph stops at restore. The template’s project file explains the line; remove it to keep NU1608 a warning.

• Upgrade every Tracon package together, Tracon.Testing.Contracts.Xunit included. Measured against 1.0.0-preview.2, these calls fail at run time when a 1.0.0-preview.2 package runs next to a newer sibling: Tracon.AspNetCore calls TenantProviderCredentialResolver.ValidatePrefix (a tenant provider binding PUT) and InboundTriggerSecretResolver.ValidatePrefix (a trigger save), which no longer exist (MissingMethodException), and ConfigurationKeyGuard.RequirePrefix (an MCP server or webhook save), which is no longer reachable (MethodAccessException); Tracon.Mcp calls ConfigurationKeyGuard.RequirePrefix when it opens an MCP transport; and Tracon.Testing.Contracts.Xunit calls JobPayload.ExtractItems (two JobScheduleStoreContract cases) and WorkflowCheckpointState.IsOmitted (one WorkflowCheckpointStoreContract case), which are now internal (MethodAccessException). The published 1.0.0-preview.1 and 1.0.0-preview.2 packages accept any newer sibling, so restore does not stop that graph: a host stops at start-up, and a test project that runs the store contracts without a host fails at those calls.

• QuotaUsageQuery has a new PeriodStarts filter: for each period, the first day whose counters to return, computed by the caller from the configured time zone. Without it, IQuotaStore.GetUsageAsync returns every period’s counters, and its documentation now says so. A custom IQuotaStore must apply the filter; QuotaStoreContract has four new scenarios for it.

• An interval that drives a background timer now fails startup validation when it is outside 1 millisecond to about 49.7 days: Approvals:ScanInterval, Canary:ScanInterval, RunReconciliation:HeartbeatInterval and ScanInterval, Scheduling:PollInterval, Health:BackgroundInterval and Mcp:RefreshInterval. Scheduling:LeaseDuration may be at most about 99 days and SingletonExecution:LeaseDuration about 149 days, because each lease renews at a fraction of its length. Each of these checks applies only while its feature is on. Retention:BatchDelay may be zero and is always held to at most about 49.7 days. Before, such a value let the host report that it had started and then stopped it; approval expiration is on by default, so Approvals:ScanInterval=00:00:00 did this to a default setup.

• The tracon.quota.usage, tracon.quota.limit and tracon.job.queue.depth gauges no longer read the database inside the metrics collection callback. When a gauge is enabled, a background service reads the values once at startup and then every QuotaUsageRefreshInterval / JobQueueDepthRefreshInterval. A collection only reads the last result. The first collection after startup can be empty, and a value can be up to one interval old.

• EnableQuotaUsageGauge, EnableJobQueueDepthGauge and their refresh intervals are now read at host start. Turning a gauge on, or changing its interval, takes effect at the next start.

• An enabled gauge whose refresh interval is outside 1 millisecond to about 49.7 days now fails startup validation. Before, zero was accepted and meant a refresh on every collection.

• A PUT /api/mcp-servers/{name} or PUT /api/webhooks/{name} with a header value of *** is rejected with 400. A client that reads, edits and saves a record must send the real value of every header again.

• When an IRunAuthorizationHandler throws, the request is still denied (fail-closed), and Tracon now writes one Error log line in the Tracon.RunAuthorization category. The line holds the handler type, the access kind, the tenant, agent, run and session ids, and the exception. A 403 now says The run authorization check failed. Retry the request. instead of claiming that the handler denied the call. This covers run starts, the session list, the run, attachment and approval lists, replay, and workflow resume and respond. A 404 does not change. The exception text never enters the response.

• A session management policy (TraconSessionOwnershipOptions.ManagementPolicy) whose policy provider or requirement handler throws is now logged as an Error in the Tracon.SessionOwnership category, and the caller still gets the narrowed result. An unregistered policy writes no log line. An IRunAttributionContext that throws during an authorization check is logged once per request, and the caller is treated as having no identity.

• An IAuthorizationPolicyProvider that throws while MapTracon resolves a role policy is now logged as a Warning in the Tracon.RolePolicies category. The role is still treated as not registered. With RequireRolePolicies on, the startup exception carries the provider’s exception as InnerException.

• SandboxedSkillScriptRunner.RunStoredScriptAsync takes the skill and the script name (RunStoredScriptAsync(AgentSkillDefinition skill, string scriptName, JsonElement? arguments, CancellationToken cancellationToken)), so the runner compares the grant with the content it is about to run. The (string skillName, AgentSkillScriptDefinition script, ...) overload is gone.

• GET /api/skills/{name} resolves the name the way the runtime does: a skill registered in code wins over a stored one with the same name, and the new origin field says which one was returned. A name that exists only in code now returns the skill instead of 404. Each script carries the new contentHash and the skill the new scriptSetHash; both are computed, and a value sent in a request is ignored.

• PUT /api/skills/{name} answers 409 for a name registered in code with AddSkill, the same rule as a code-defined agent: the code skill wins the name, so a stored skill under it never ran. Before, the save succeeded and wrote a record that never ran. DELETE still removes such a stored copy and answers 409 when the name has none. The console opens a code skill read only.

• The in-memory script grant store keeps a revoked grant, with revokedAt set, the same as the SQL stores. Before, it deleted the row, so GET /api/skill-script-grants lost the record of who granted what.

• TenantProviderCredentialResolver takes IOptions<TraconOptions> as a third constructor argument, and ValidatePrefix(string) is replaced by ValidateKeyName(string tenantId, string configurationKeyName). The old name checked only the prefix; the rename keeps a caller from compiling against the weaker rule unchanged.

• ToolApprovalRuleStoreContract (in Tracon.Testing.Contracts.Xunit) has two new cases. A store of your own must keep two condition sets apart even when a path carries a control character, and must treat a list value that differs only in whitespace between its elements as the same condition. The identity rule is now written on IToolApprovalRuleStore.AddAsync. A store that compares a list value’s raw JSON text fails the second case.

• The out-of-catalog log entry of the OpenAI, Anthropic, and Google providers now has one shared wording (Use the <key> setting to add the model to the catalog.). The Gemini health detail for an unparsable model list is now The response is not valid JSON., the same as the other providers.

Deprecated

• McpServerDefinition.AuthorizationConfigurationKey and McpServerRequest.AuthorizationConfigurationKey (authorizationConfigurationKey on the wire). They still save, resolve and read back, and are removed in 1.0.0. Use HeaderConfigurationKeys["Authorization"]; a record that names Authorization in both, or in the new map while OAuth is on, returns 400. Code that sets the field compiles with warning CS0618.
• QuotaUsageQuery.AsOf. No store ever applied it, and a store cannot turn an instant into a period without the configured time zone. Use QuotaUsageQuery.PeriodStarts.
• The net8.0 and net9.0 targets. Microsoft support for .NET 8 and .NET 9 ends on 2026-11-10, and the first Tracon release after that date drops both targets from every package; net10.0 stays. An urgent security release may still carry them. Move an application that targets net8.0 or net9.0 to net10.0 before you take that release.

A version section is not written ahead of time. At tag time this heading is renamed to the version and the date it shipped on, and a fresh empty ## [Unreleased] is opened above it, so a section always names artifacts that actually exist. Until then the release rehearsal and the GitHub release body both read the notes from here.

1.0.0-preview.2 — 2026-09-20

The consumer-entry repair release. It keeps the same public API as preview.1 and corrects the package, documentation, and registry paths a new consumer meets first.

Fixed

• Tracon.Templates now stamps its own resolved package version into generated projects. dotnet new tracon-api therefore restores the published preview without a hidden --TraconVersion override. The override remains available and is now visible in template help.
• The root README agent-catalog example now calls the shipped ResolveAsync overload with its required culture and cancellation arguments.
• Package descriptions, package READMEs, API counts, target-framework claims, extension samples, and console screenshots now match the shipped artifacts.
• NuGet-rendered package documentation no longer relies on Mermaid rendering.

Added

• tracon --version and tracon -v report the informational package version.
• The TypeScript client README documents all seven SSE operations and its exported readSse/SseDecoder helpers.
• Regression gates now verify the packed template’s default version, rendered GitHub edit links, package README operation counts, shipped-language scope, and console screenshot freshness against UI source.

Changed

• Preview npm releases use the next dist-tag, so install previews with npm install @tracon/client@next. npm does not let the latest tag be removed, and a package’s first publish binds latest to it, so latest tracks the newest preview until the first stable release claims it.
• GitHub repository metadata, Discussions, preview release classification, and public documentation links now describe the published product.

1.0.0-preview.1 — 2026-09-20

The first published version: twenty packages on one version line.

The public API is not frozen: PublicAPI.Shipped.txt is empty in every package, and the surface may still be reduced before 1.0.

Added

• RequireProductionProfile() on the Tracon chain. AddTracon() brings every security-sensitive switch up permissive, so a deployment can reach production having never separated tenants, never decided who owns a session and never registered a content guard — in silence. This call refuses to start such a host. It changes no setting and secures nothing by itself: it sets no value, chooses no policy and turns nothing on; the only thing it does is turn a skipped decision into a startup failure. Six decisions are asked about — tenant separation, session ownership, at-rest content protection, content inspection, request rate limiting and retention — and each is either answered by turning the feature on or accepted by name with profile.Accept(TraconProductionRisk.SingleTenant). There is no way to accept all six at once, and every accepted risk is logged at information level, by name, on each host start. It is off by default: a host that never calls it behaves exactly as before and resolves nothing extra at startup. The set of decisions is a versioned contract: a later release that adds one stops a host that calls this method until the new decision is answered or accepted, and such a release declares the addition as a behavioural breaking change naming the new risk and why it was added. IProductionProfileCheck is the seam behind it — more than one check may carry the same risk, and the strictest answer wins, which is how Tracon.AspNetCore adds the UseTenancy(options => options.Enabled = false) case the core cannot see.
• Tracon:SessionOwnership:RefuseUnownedSessions (default false). Session ownership is not retroactive, so rows written before it was turned on belong to nobody; until now those stayed readable by id to anyone in the tenant, and only disappeared from owner-filtered listings. With this on they are refused instead — 404 on the session and /v1/conversations routes, 403 (errorType session_owner_required) on a run that names one, 404 on a voice socket. A caller who satisfies ManagementPolicy still reads them, so support keeps the access it already had in the management listing; that exemption does not extend to starting a run. A session that does not exist yet is unaffected: the first turn still opens it and claims it.
• TraconEndpointOptions.MapOpenAIConversations (default true). Set it to false in MapTracon to leave the four /v1/conversations routes unmapped; they then answer 404 and disappear from the OpenAPI document. /v1/responses and /v1/chat/completions are unaffected.

Changed

• Licence. Tracon now ships under the PolyForm Small Business License 1.0.0 instead of MIT. Use is free of charge for an individual, an open source project, and any company with fewer than 100 total individuals working as employees and independent contractors and less than 1,000,000 USD (2019, inflation adjusted) revenue in the prior tax year; above that threshold a commercial licence applies (hfarukatasoy@gmail.com). Three packages stay MIT so that writing an extension, proving it against the behaviour contracts, and owning the code dotnet new generates never need one: Tracon.Abstractions, Tracon.Testing.Contracts.Xunit and Tracon.Templates. The npm client @tracon/client follows its NuGet twin and is PolyForm. No package contains a licence key, an activation call or a feature gate, and the licence of a published version never changes. Because PolyForm is not OSI approved, packages now declare <license type="file"> and carry the text inside the .nupkg rather than naming an SPDX expression. Nothing was published under MIT, so no existing consumer is affected. See /reference/licensing/.

• The /v1/conversations read and delete routes now go through your registered IRunAuthorizationHandler. GET /v1/conversations/{id}, GET /v1/conversations/{id}/items and DELETE /v1/conversations/{id} ask it with SessionAccess.Read, Read and Delete; they previously never asked it at all, while /api/sessions/{id} did. If you have a handler registered that refuses some sessions, it now refuses them on this surface too. The direction is fail-closed and it closes a real gap — an installation whose handler denied GET /api/sessions/{id} had GET /v1/conversations/{id}/items hand back the same chat history — but it is a behaviour change for existing setups. POST /v1/conversations is not gated: it reserves an identifier and writes nothing.

Added — foundation

• Model provider adapters for OpenAI (Chat Completions and Responses), Anthropic (Claude), Google (Gemini), and Azure OpenAI, plus an IModelProvider extension point for any other provider — with per-tenant bring-your-own-key (BYOK) support and per-tenant egress policy.
• Persistence backends for PostgreSQL, SQL Server, and SQLite, each with embedded migrations; the runtime (Tracon.Core) needs no database.
• An embedded React console — 30 screens across 36 routes (Dashboard, Agents, Skills, Playground, Sessions, Runs, Workflows, Jobs, Evals, Experiments, Approvals, Tools, Models, MCP, Triggers, Audit, Diagnostics, Settings) — with zero JavaScript dependency in the consuming project.
• A management HTTP API alongside OpenAI-compatible endpoints (/v1/responses, /v1/chat/completions, /v1/conversations). Multi-tenancy is opt-in: TraconTenancyOptions.Enabled is false by default and every request resolves to the single default tenant until you turn it on.
• Run recording with spans, metrics, and cost; a tamper-evident audit trail with a verifiable hash chain; data subject export and erasure.
• Cost provenance: a priced run records the unit prices actually applied and the provider that answered it, so a historical cost stays explainable after the price list changes.
• Named job lanes: a job carries a lane, a worker subscribes to the lanes it serves, and each lane can hold its own concurrency budget — unrelated kinds of background work no longer block one another. Queue depth, throughput, and duration are reported as OpenTelemetry metrics.
• Opt-in structured-response validation: when an agent asks for JSON or a JSON schema, the response can be checked before the run closes, with a bounded repair turn that stays inside the same run’s budget, cost accounting, and cancellation. A run that carries a durable session gets no repair budget: the underlying agent framework persists a turn as soon as that one model call completes, so a repaired run would return an answer its own session never recorded. Such a rejection fails the run exactly as it would with repair switched off, and its rejection event carries repairSuppressedBySession to tell that apart from a run that simply had no repair configured.
• Tool schemas generated from your method signatures express JSON Schema constraints taken from standard System.ComponentModel.DataAnnotations attributes, and support nested object and object-array parameters.
• Extension points for custom tools, model providers, run stores, run judges, agent sources, and scheduled job handlers, each with a published behavior-contract test suite (Tracon.Testing.Contracts.Xunit) so a third-party implementation can be verified against the same tests Tracon’s own implementations run.
• Workflow execution with five orchestration patterns, checkpoints, resume, and human-in-the-loop approval.
• MCP tool discovery from remote servers, and agent exposure over MCP and A2A.
• A typed management client generated from the OpenAPI document, published both as a NuGet package (Tracon.Client) and an npm package (@tracon/client).
• A dotnet new tracon-api project template and an tracon global CLI tool (migrate, migrate status, health, eval).
• Native AOT and trimming compatibility for Tracon.Abstractions, Tracon.Core, Tracon.PostgreSql, Tracon.OpenAI, Tracon.Anthropic, Tracon.Google, Tracon.Azure, and Tracon.Voice.

Read next

• Versions and upgrades — how to pin the family and upgrade it without drift
• Compatibility matrices — the framework, runtime, and protocol versions each release supports
• Choosing packages — which packages you actually take a version of