Release

Announcing Toise 0.9.1 — hardening after an engineering review

Released 2026-07-03 · written up 2026-09-30

0.9.1 is the result of a full engineering review of 0.9.0. It tightens a handful of correctness and durability paths, hardens two security defaults, and finishes a feature that was wired on one side only. Every change is backward compatible: no wire-contract break, no data migration.

Identity beliefs, end to end

A producer can now say that two nodes are the same real thing, with a confidence and a basis — for example confidence 0.95, basis ifPhysAddress. The SDK exposes it as Relationship.Confidence and .Basis, and ingest accepts confidence and basis on the same_as descriptor.

The read-time canonical overlay (ADR 0020) already knew how to collapse such beliefs; until this release nothing could feed it. Belief attributes ride only on same_as edges, and the conformance kit advises when a confidence is missing or outside [0,1].

Correctness and durability

• Past-instant reads near the retention horizon. After pruning, an as-of read could omit a still-live entity whose only surviving event was a recent heartbeat. Retention now writes a baseline event at the horizon for such entities, and cleans up after itself.
• Audit attribution. The audit trail recorded operator annotations under the default tenant. The tenant router now stamps the resolved tenant, so every write is attributed to the tenant it targeted.
• Log restore. A restore now checks that shipped segments are contiguous and stops on a gap or overlap rather than rebuilding from them.
• Tenant lifecycle. The tenant cap is enforced atomically under concurrent first use, and delete-tenant refuses to run against a live server.
• Mass expiry. When a producer's whole subtree lapses at once, the sweep commits in a single durable batch instead of one write per entity and edge.
• Conformance kit and producer guide. The kit now accepts the entity.description form Toise itself emits, and the guide no longer suggests retrying a permanent PartialError.

Security

• OIDC / JWT role claim. A configured role claim that is absent, empty or unrecognised is now rejected instead of falling back to the full role.
• ingest_mtls_only. A configuration that would leave the read surface without an authenticator is refused at startup.

Get it

go install github.com/toise-dev/toise/cmd/toise-server@v0.9.1

Binaries for linux and darwin (amd64 / arm64) are on the release, each with a checksum, and the container image is on GHCR. See the 0.9.1 docs and the changelog. Producers get this release's SDK with pkg/emit/v0.4.0.