Merge branch 'dev' into feat/http_ext_fields

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

.github/workflows/ci.yml

@@ -109,15 +109,28 @@ jobs:
           fetch-depth: 1
       - name: Install Rust 1.96.0
         uses: dtolnay/rust-toolchain@1.96.0
-      - uses: Swatinem/rust-cache@v2
+      # NOTE: intentionally NO Swatinem/rust-cache here, AND we wipe the registry
+      # index before packaging. The committed Cargo.lock is byte-identical to a
+      # fresh x86_64 resolution (verified in an amd64 container), so the lock is
+      # not the problem. The failure comes from stale `~/.cargo/registry` state
+      # the hosted runner carries: under the sparse protocol `cargo package
+      # --locked` consults that partial local index, decides it can't satisfy the
+      # committed lock, and aborts with "cannot update the lock file ... --locked"
+      # ~1.4s in (too fast for a real network fetch). Removing the index forces a
+      # clean fetch, against which Cargo.lock resolves cleanly — keeping this
+      # dry-run deterministic.
       # Continuous dry-run of the crates.io release: build + verify a .crate for
       # every publishable member without uploading. Catches publishability
       # regressions (missing version reqs, packaging-excluded files, broken
       # inter-crate deps) on every push/PR, long before a release tag. Mirrors
       # `make publish-dry` and the release workflow's dry-run. The two
       # `publish = false` FFI crates are excluded (not part of the registry set).
       - name: cargo package (no upload)
-        run: cargo package --workspace --locked --exclude cpex-ffi --exclude cpex-demo-ffi
+        run: |
+          # Drop any pre-seeded registry index/cache so cargo fetches fresh and
+          # --locked resolves against a clean index (see note above).
+          rm -rf ~/.cargo/registry/index ~/.cargo/registry/cache
+          cargo package --workspace --locked --exclude cpex-ffi --exclude cpex-demo-ffi
 
   docs:
     name: Docs Build

.github/workflows/release.yaml

@@ -70,7 +70,11 @@ jobs:
       - uses: actions/checkout@v7
       - name: Install Rust 1.96.0
         uses: dtolnay/rust-toolchain@1.96.0
-      - uses: Swatinem/rust-cache@v2
+      # NOTE: intentionally NO Swatinem/rust-cache here. A restored partial
+      # `~/.cargo/registry` index makes `cargo package/publish --locked` abort
+      # with "cannot update the lock file" against the sparse index even when
+      # Cargo.lock is correct (see the CI `package` job for the full rationale).
+      # A fresh index each run keeps publish resolution deterministic.
       - name: cargo publish (dependency order)
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

CHANGELOG.md

@@ -15,12 +15,21 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Changed
+
+- **BREAKING — APL authz/authn config keys renamed** for clarity. The old key names no longer parse; a config using them fails to load with an error naming the replacement (a dropped authorization or authentication block would otherwise fail open, so the rejection is deliberate). Migration:
+  - `identity:` → `authentication:` (at `global`, per-route, and policy-group scope)
+  - `policy:` → `authorization.pre_invocation:` (or flat `pre_invocation:`)
+  - `post_policy:` → `authorization.post_invocation:` (or flat `post_invocation:`)
+
+  The two authorization phases may be written either nested under an `authorization:` block or flat directly on the section; the forms are equivalent. The field-pipeline keys `args:` / `result:` are unchanged (they stay aligned with the `args.*` / `result.*` attribute namespaces that predicates and interpolation read). Internal APL IR is unchanged. (#105)
+
 ## [0.2.0] - 2026-06-26
 
 ### Added
 
 - CPEX redesign as a Rust framework with Go bindings
-- APL (Attribute Policy Language) governance is now bundled into `libcpex_ffi.a`. New `cpex_apl_install` extern C entry point registers the standard APL plugin/PDP factories (`validator/pii-scan`, `audit/logger`, `identity/jwt`, `delegator/oauth`, `cedar-direct`) and installs the APL config visitor on a manager. Call it after `cpex_manager_new_default` and before `cpex_load_config`. Go hosts use `PluginManager.EnableAPL()`. (#60)
+- APL (Authorization Policy Language) governance is now bundled into `libcpex_ffi.a`. New `cpex_apl_install` extern C entry point registers the standard APL plugin/PDP factories (`validator/pii-scan`, `audit/logger`, `identity/jwt`, `delegator/oauth`, `cedar-direct`) and installs the APL config visitor on a manager. Call it after `cpex_manager_new_default` and before `cpex_load_config`. Go hosts use `PluginManager.EnableAPL()`. (#60)
 - Publish `libcpex_ffi.a` as signed GitHub Release artifacts on every semver tag push (`linux-amd64-gnu`, `linux-arm64-gnu`, `linux-amd64-musl`, `linux-arm64-musl`, `darwin-arm64`). Cosign keyless signatures + SHA256 checksums; see `crates/cpex-ffi/RELEASE.md` for the schema and the verify-and-consume recipe. (#60)
 - FFI ABI versioning: `cpex_ffi_abi_version()` extern C accessor exposes `FFI_ABI_VERSION`. The Go binding checks this in `init()` and panics on mismatch. Other language bindings must replicate the check. (#60)
 - CEL (Common Expression Language) policy decision backend. A new `apl-pdp-cel` crate registers `kind: cel`, letting authors write inline boolean predicates (`cel: { expr: ... }`) over the common attribute vocabulary (`subject.id`, `delegation.depth`, `session.labels`, ...), evaluated through the existing `PdpResolver` seam alongside Cedar, OPA, and AuthZen. Expressions compile once and cache by source; compile errors, undeclared-variable references, and non-boolean results fail closed (deny), overridable with `on_error: allow`. No change to APL evaluation semantics. (#68)