This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+10 more
ReleasePort's take
Light signalStarting with rea‑agents 2.0.0, the mcp API now mandates Evidence for any managed reconstruction request.
Why it matters: All integrations that call mcp must supply Evidence; failure results in rejected requests (severity 70).
Summary
AI summaryUpdates ⚠ BREAKING CHANGES, Code Refactoring, and Bug Fixes across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
mcp now requires Evidence for managed reconstruction. mcp now requires Evidence for managed reconstruction. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Feature | Medium |
application adds cross-layer graph workflows. application adds cross-layer graph workflows. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
application adds isolated JavaScript replay. application adds isolated JavaScript replay. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
dotnet adds managed artifact triage. dotnet adds managed artifact triage. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
dotnet adds managed member comparison. dotnet adds managed member comparison. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
dotnet adds managed member inspection. dotnet adds managed member inspection. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
dotnet adds managed native boundary inspection. dotnet adds managed native boundary inspection. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
dotnet adds managed runtime correlation planning. dotnet adds managed runtime correlation planning. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
dotnet adds import of managed reconstructions. dotnet adds import of managed reconstructions. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
electron maps static process and IPC boundaries. electron maps static process and IPC boundaries. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
electron reconciles static artifacts with passive runtime. electron reconciles static artifacts with passive runtime. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
managed projects static evidence into application graph. managed projects static evidence into application graph. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
mcp hardens contracts and evidence references. mcp hardens contracts and evidence references. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
deps run freshness check from escaped paths. deps run freshness check from escaped paths. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
mcp aligns runtime unknown argument validation. mcp aligns runtime unknown argument validation. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
mcp hides managed workflows without a session. mcp hides managed workflows without a session. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
mcp integrates managed contracts after rebase. mcp integrates managed contracts after rebase. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
mcp normalizes inferred field descriptions. mcp normalizes inferred field descriptions. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
mcp parses adapter inputs exactly once. mcp parses adapter inputs exactly once. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
mcp removes arbitrary schema byte gate. mcp removes arbitrary schema byte gate. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
mcp removes schema byte compaction. mcp removes schema byte compaction. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
package accepts expected doctor diagnostics. package accepts expected doctor diagnostics. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
mcp removes obsolete managed evidence parser. mcp removes obsolete managed evidence parser. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
2.0.0 (2026-07-16)
⚠ BREAKING CHANGES
- mcp: require Evidence for managed reconstruction
- mcp: comparison tools now require session-owned Evidence IDs or approved bundle paths, and structured Evidence results use compact references.
Features
- application: add cross-layer graph workflows (778b995)
- application: add isolated JavaScript replay (d86231a)
- dotnet: add managed artifact triage (c251c38)
- dotnet: add managed member comparison (55794d6)
- dotnet: add managed member inspection (98cad37)
- dotnet: add managed native boundary inspection (466b1bb)
- dotnet: add managed runtime correlation planning (5f66cfd)
- dotnet: import managed reconstructions (c506664)
- dotnet: verify managed native boundaries (8cbc125)
- electron: map static process and IPC boundaries (3fa2304)
- electron: reconcile static artifacts with passive runtime (8c67dbd)
- managed: project static evidence into application graph (6194c1a)
- managed: project static evidence into application graph (77178bb)
- mcp: harden contracts and evidence references (ee1cd40)
- mcp: require Evidence for managed reconstruction (d36af5d)
- setup: verify installed skill catalog identity (b2d1f2a)
Bug Fixes
- deps: run freshness check from escaped paths (8a1c128)
- mcp: align runtime unknown argument validation (d1e7220)
- mcp: hide managed workflows without a session (412bbaf)
- mcp: integrate managed contracts after rebase (9c4a93d)
- mcp: normalize inferred field descriptions (a807471)
- mcp: parse adapter inputs exactly once (37c0f39)
- mcp: remove arbitrary schema byte gate (fd08025)
- mcp: remove schema byte compaction (f728295)
- package: accept expected doctor diagnostics (0f2d013)
- test: make host fixtures portable (f23f529)
Code Refactoring
- mcp: remove obsolete managed evidence parser (f7aa191)
Documentation
- analysis: define managed-code evidence boundary (80faff3)
- api: refresh managed reconstruction contracts (2b06433)
- dotnet: refresh managed reconstruction api (cc1e47c)
- refresh application workflow API links (4a30820)
- refresh managed native verification api (849c052)
- refresh managed runtime api docs (798631a)
- refresh runtime reconciliation API (87b2348)
- security: define controlled replay authority (461990d)
- stabilize replay API source links (a8c1057)
Tests
- dotnet: add managed conformance verifier (2b75fcf)
- dotnet: verify managed app graph manifests (5be4051)
- dotnet: verify managed app graph manifests (a5e5c68)
- dotnet: verify managed app manifests (793a948)
- hopper: avoid scheduler-sensitive exit timing (6e6827c)
- mcp: cover strict compact wire contracts (8de25d0)
- mcp: derive sessionless managed inventory (cab7c4a)
- replay: use portable seam executables (3183f47)
Breaking Changes
- **mcp:** require Evidence for managed reconstruction
- **mcp:** remove obsolete managed evidence parser
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Rea
All releases →Related context
Related tools
Earlier breaking changes
- vrea-agents-1.0.0 contracts APIs now return structured discriminated output shapes
- vrea-agents-0.3.0 rename identity package and CLI to REA
- vrea-0.2.0 rename identity package and CLI to REA
Beta — feedback welcome: [email protected]