From 27379d16dfabe95f2901403b85ba2ee38367924b Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:50:52 -0400
Subject: [PATCH] =?UTF-8?q?release:=20v0.17.0=20=E2=80=94=20the=20deployme?=
 =?UTF-8?q?nt=20carries=20the=20composition=20that=20judges=20it,=20and=20?=
 =?UTF-8?q?the=20runtime=20image=20it=20runs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A minor: both changes add a field to a request contract that agents read.

  #752  fix(builder)!  the deploy request carries the composition's members
        (CompositionProvenance), and the agent judges its dependency edges
        with THAT, not with whatever workspace sits above the module cache.
        For every module composed from a release the cache held the module
        repo's dev workspace, naming the module by its repo-local name, so
        every edge to the host was refused as unjudged (#751; proposal
        obin-ai/handbook#266).
  #749  feat(runtime)!  InitRequest carries the runtime image the CLI built
        from the agent's recipe, so a local run of a container-only service
        is given its image instead of asking for one (#748; proposal
        obin-ai/handbook#260).

Also since v0.16.0: x/net v0.60.0 and Go 1.27.2 (the HTTP/2 and stdlib CVEs),
with CI's toolchain pin moved alongside and the ciguard job shapes re-recorded.

Consumers: the CLI (cli#938, cli#932) fills both fields; every agent picks
them up with its next core bump. Verified by experiment: all seven service
agents (go, go-grpc, nextjs, python-fastapi, redis, vault, postgres) build
against this tree unchanged.
---
 version/info.codefly.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version/info.codefly.yaml b/version/info.codefly.yaml
index 085c0f4a..273c5dfe 100644
--- a/version/info.codefly.yaml
+++ b/version/info.codefly.yaml
@@ -1 +1 @@
-version: 0.16.0
+version: 0.17.0