Release VGI 0.43.0 with published RPC dependencies

Author: rustyconover

.github/workflows/ci.yml

@@ -5,8 +5,7 @@
 # ever compiles the example worker -- vgi/src/test carried 278 JUnit tests that
 # nothing in CI ran. This workflow is that gate.
 #
-# vgi-rpc-java is built from source here for the same reason integration.yml
-# does it (see the pin's comment there); keep VGI_RPC_JAVA_REF in step with it.
+# Resolve the same Maven Central RPC dependencies as published SDK consumers.
 name: CI
 
 on:
@@ -22,43 +21,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  # The vgi-rpc-java revision built from source via the composite include. The
-  # composite substitutes the `farm.query:vgirpc` coordinate declared in
-  # vgi/build.gradle.kts, so this ref -- not the declared version -- is what
-  # :vgi:compileJava actually compiles and runs against here. A stale pin fails
-  # as `cannot find symbol` on whatever the newer vgirpc added, or as a runtime
-  # marshalling error. Because CI builds this ref from source while the
-  # published artifact resolves the declared version, the two can silently
-  # disagree: keep this tag and `farm.query:vgirpc` in vgi/build.gradle.kts
-  # pointing at the same release, and move them in the same commit.
-  #
-  # v0.25.1 is what carries `@ProtocolName`, without which this repo cannot
-  # declare the `vgi.v2` wire name at all: the name would fall back to the
-  # VgiService interface's simple name, and no Java identifier contains a dot.
-  # A stale pin here fails as `cannot find symbol: class ProtocolName`.
-  #
-  # v0.27.0 moves to Apache Arrow 19 (Netty 4.2), so arrow-c-data in
-  # vgi-example-worker/build.gradle.kts moves with this pin.
-  #
-  # (It had earlier been an untagged SHA, 920dc42, because no release yet
-  # carried the `writeListElement` LargeBinary case; v0.25.0 contains it.)
-  #
-  # v0.28.0 adds RpcServer.addProtocol, the error model and the Identity
-  # translation that Worker.hostedProtocols / resolveToken build on; a stale
-  # pin fails as `cannot find symbol: method addProtocol`, and the
-  # hosted-protocols job below cannot pass without it.
-  #
-  # v0.29.0 adds sealed grants and resolveToken-backed bearer authentication
-  # (GrantKeys, IdentityBearer) that Worker.grantKeys builds on.
-  #
-  # v0.30.0 adds the public reflection client (Introspect.listProtocols /
-  # describeProtocol).
-  #
-  # v0.31.0 makes identity.XChaCha20Poly1305 public; AttachTickets uses it
-  # instead of a copy.
-  # Keep in step with the identical pin in integration.yml.
-  # Source revision for 0.33.1; replace with v0.33.1 after the package release.
-  VGI_RPC_JAVA_REF: 3a8a300a10226be1b56e0458e81ffa3212b73f1d
+  # Disable local sibling substitution: validate the released Maven dependency.
+  VGI_RPC_JAVA_DIR: /nonexistent
 
 jobs:
   test:
@@ -68,13 +32,6 @@ jobs:
       - name: Checkout vgi-java
         uses: actions/checkout@v4
 
-      - name: Checkout pinned vgi-rpc-java
-        uses: actions/checkout@v4
-        with:
-          repository: Query-farm/vgi-rpc-java
-          ref: ${{ env.VGI_RPC_JAVA_REF }}
-          path: vgi-rpc-java
-
       - name: Set up JDK 25
         uses: actions/setup-java@v4
         with:
@@ -92,15 +49,11 @@ jobs:
 
       - name: Unit tests
         run: ./gradlew --no-daemon :vgi:test
-        env:
-          VGI_RPC_JAVA_DIR: ${{ github.workspace }}/vgi-rpc-java
 
       # The published artifact carries javadoc, so a doc comment that does not
       # build is a broken release, not a warning.
       - name: Javadoc
         run: ./gradlew --no-daemon :vgi:javadoc
-        env:
-          VGI_RPC_JAVA_DIR: ${{ github.workspace }}/vgi-rpc-java
 
       - name: Upload test report on failure
         if: failure()
@@ -124,13 +77,6 @@ jobs:
       - name: Checkout vgi-java
         uses: actions/checkout@v4
 
-      - name: Checkout pinned vgi-rpc-java
-        uses: actions/checkout@v4
-        with:
-          repository: Query-farm/vgi-rpc-java
-          ref: ${{ env.VGI_RPC_JAVA_REF }}
-          path: vgi-rpc-java
-
       - name: Set up JDK 25
         uses: actions/setup-java@v4
         with:
@@ -161,8 +107,6 @@ jobs:
 
       - name: Build example worker
         run: ./gradlew --no-daemon :vgi-example-worker:installDist
-        env:
-          VGI_RPC_JAVA_DIR: ${{ github.workspace }}/vgi-rpc-java
 
       - name: Run hosted-protocols group
         run: ci/run-hosted-protocols.sh

.github/workflows/integration.yml

@@ -21,13 +21,8 @@ concurrency:
 env:
   # Match the test suite to the native runner built from this exact revision.
   VGI_REF: 3a2249f815ff6e2a8b5289a3e6284326084e3630
-  # The vgi-rpc-java revision built from source (composite include) for the
-  # worker's HTTP features. The composite substitutes the `farm.query:vgirpc`
-  # coordinate declared in vgi/build.gradle.kts, so this ref, not the declared
-  # version, is what the worker actually compiles against: see the pin's full
-  # comment in ci.yml, and keep the two in step.
-  # Source revision for 0.33.1; replace with v0.33.1 after the package release.
-  VGI_RPC_JAVA_REF: 3a8a300a10226be1b56e0458e81ffa3212b73f1d
+  # Disable local sibling substitution: validate the released Maven dependency.
+  VGI_RPC_JAVA_DIR: /nonexistent
 
 jobs:
   build-worker:
@@ -37,13 +32,6 @@ jobs:
       - name: Checkout vgi-java
         uses: actions/checkout@v4
 
-      - name: Checkout pinned vgi-rpc-java
-        uses: actions/checkout@v4
-        with:
-          repository: Query-farm/vgi-rpc-java
-          ref: ${{ env.VGI_RPC_JAVA_REF }}
-          path: vgi-rpc-java
-
       - name: Set up JDK 25
         uses: actions/setup-java@v4
         with:
@@ -61,8 +49,6 @@ jobs:
 
       - name: Build example worker
         run: ./gradlew --no-daemon :vgi-example-worker:installDist
-        env:
-          VGI_RPC_JAVA_DIR: ${{ github.workspace }}/vgi-rpc-java
 
       # Archive before upload because upload-artifact does not preserve the
       # executable bit on the generated launcher script.

CLAUDE.md

@@ -188,8 +188,8 @@ change to `~/Development/vgi-rpc-java/` doesn't show up, run
 ## Releasing (Maven Central)
 
 Published: **`farm.query:vgi`** (this repo) and **`farm.query:vgirpc`** /
-`vgirpc-oauth` (the sibling). Latest as of 2026-10-20: **vgi 0.42.0 → vgirpc
-0.33.0**. To cut a release: bump `version` in `build.gradle.kts`, push, then
+`vgirpc-oauth` (the sibling). Latest as of 2026-10-21: **vgi 0.43.0 → vgirpc
+0.33.1**. To cut a release: bump `version` in `build.gradle.kts`, push, then
 create a GitHub Release whose tag is the version (`v0.2.0` for `0.2.0`). The
 `release.yml` workflow (trigger: `release: published`) verifies tag == version,
 runs tests, and publishes. Both repos now set
@@ -201,8 +201,8 @@ Maven Central with no manual Portal click** once it passes validation (changed
 `farm.query:vgirpc` from **Maven Central** (the composite is absent on CI —
 `VGI_RPC_JAVA_DIR` unset), *not* from source. So **`:vgi` cannot release until
 the `vgirpc` version it pins in `vgi/build.gradle.kts` is already published to
-Maven Central.** Integration CI hides this (it builds vgirpc from source via the
-composite), so green integration ≠ releasable. Before tagging a `:vgi` release,
+Maven Central.** CI now resolves the same published Maven dependency; local sibling builds
+can still substitute source. Before tagging a `:vgi` release,
 prove it builds against the *published* vgirpc with the composite disabled:
 
 ```bash

README.md

@@ -19,6 +19,8 @@ VGI lets [Haybarn](https://github.com/Query-farm-haybarn/haybarn) — Query Farm
 
 Wire-compatible with the [Python reference implementation](https://github.com/Query-farm/vgi-python) and the [Go port](https://github.com/Query-farm/vgi-go): all three serve the same integration suite against the same C++ extension.
 
+Version 0.43.0 uses VGI wire 2.2.0 under `vgi.v2` and requires a native VGI client speaking wire 2.2.x. Upgrade clients and workers together; wire 2.1 clients are incompatible. See [catalog metadata and publication](docs/catalog_publication.md).
+
 ## What you can serve
 
 - **Catalog tables** — named tables with inline schemas, comments, tags, constraints, foreign keys, and per-column statistics that feed the engine's optimizer.
@@ -43,7 +45,7 @@ Artifacts are published to Maven Central under the `farm.query` group.
 
 ```kotlin
 dependencies {
-    implementation("farm.query:vgi:0.42.0")
+    implementation("farm.query:vgi:0.43.0")
 }
 ```
 
@@ -53,7 +55,7 @@ dependencies {
 <dependency>
   <groupId>farm.query</groupId>
   <artifactId>vgi</artifactId>
-  <version>0.42.0</version>
+  <version>0.43.0</version>
 </dependency>
 ```
 

build.gradle.kts

@@ -8,7 +8,7 @@ plugins {
 
 allprojects {
     group = "farm.query"
-    version = "0.42.0"
+    version = "0.43.0"
 
     repositories {
         mavenCentral()

docs/catalog_publication.md

@@ -17,4 +17,4 @@ The manager exposes startup warming, trusted manifest import, and conditional in
 
 Java: call `Worker.catalogSnapshot(policy)`. Use `policy.manager.warm`, `importPublication`, and `invalidate`. This implementation requires `farm.query:vgirpc:0.33.1`, including its collection row codec and idempotent IPC stream termination.
 
-CI pins the matching RPC source commit while the separate 0.33.1 Maven release is pending. Publish that RPC release before publishing this SDK.
+Version 0.43.0 requires native clients and workers on wire 2.2.x; wire 2.1 is incompatible. The protocol route remains `vgi.v2`. CI and release builds resolve RPC 0.33.1 from Maven Central.

examples/docs/build.gradle.kts

@@ -10,7 +10,7 @@
 // the SDK at HEAD and a breaking change shows up here rather than in a reader's
 // editor. A reader does the same thing with one line instead:
 //
-//     implementation("farm.query:vgi:0.41.1")
+//     implementation("farm.query:vgi:0.43.0")
 //
 // which is what the documentation shows. The toolchain, `-parameters` and the
 // JVM opens all come from the root build, so nothing else is repeated here.