contextforge-org
diff --git a/‎CHANGELOG.md‎
Lines changed: 10 additions & 1 deletion b/‎CHANGELOG.md‎
Lines changed: 10 additions & 1 deletion
diff --git a/‎Cargo.lock‎
Lines changed: 18 additions & 18 deletions b/‎Cargo.lock‎
Lines changed: 18 additions & 18 deletions
diff --git a/‎Cargo.toml‎
Lines changed: 16 additions & 16 deletions b/‎Cargo.toml‎
Lines changed: 16 additions & 16 deletions
diff --git a/‎README.md‎
Lines changed: 20 additions & 17 deletions b/‎README.md‎
Lines changed: 20 additions & 17 deletions
diff --git a/‎builtins/pdps/cedar-direct/src/factory.rs‎
Lines changed: 6 additions & 7 deletions b/‎builtins/pdps/cedar-direct/src/factory.rs‎
Lines changed: 6 additions & 7 deletions
diff --git a/‎builtins/pdps/cel/src/factory.rs‎
Lines changed: 3 additions & 4 deletions b/‎builtins/pdps/cel/src/factory.rs‎
Lines changed: 3 additions & 4 deletions
diff --git a/‎builtins/session/valkey/src/config.rs‎
Lines changed: 7 additions & 7 deletions b/‎builtins/session/valkey/src/config.rs‎
Lines changed: 7 additions & 7 deletions
diff --git a/‎builtins/session/valkey/src/connection.rs‎
Lines changed: 1 addition & 1 deletion b/‎builtins/session/valkey/src/connection.rs‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎builtins/session/valkey/src/error.rs‎
Lines changed: 1 addition & 1 deletion b/‎builtins/session/valkey/src/error.rs‎
Lines changed: 1 addition & 1 deletion
@@ -13,7 +13,14 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 > - **Fixed**: for any bug fixes.
 > - **Security**: in case of vulnerabilities.
 
-## [Unreleased]
+## [0.2.1] - 2026-07-14
+
+### Added
+
+- **HTTP request-line attributes.** `HttpExtension` now carries optional `method` / `path` / `host` / `scheme`, surfaced in the APL attribute bag as `http.method` / `http.path` / `http.host` / `http.scheme` so CEL/APL predicates can reason over the HTTP request line. They ride the existing `read_headers` capability (the `http` extension slot is gated as a whole). `http.host` must be populated from a validated request authority (e.g. HTTP/2 `:authority`), never a raw client `Host` header, so host-based policy cannot be spoofed.
+- **Custom denial response (`response:` block).** A route — or `global` — may declare a custom HTTP `status` / `body` / `headers` for its denials via a `response:` block (a sibling of `authorization:`). On a deny, these are carried on `PluginViolation.details` (`http.status` / `http.body` / `http.headers`) for the host to render; absent, the host default is unchanged. No new APL grammar and no new `PluginViolation` fields. It is scope-local: a `global` response is not inherited by entity routes, and the block warns (inert) at `defaults` / policy-bundle scope.
+- **Entity-less HTTP authorization.** The catch-all `global` policy now authorizes generic (non-MCP/A2A) HTTP requests that carry no entity, via new reserved coordinates (`http` / `*`) and the `cmf.http_request` hook. A host fires `cmf.http_request` with those coordinates; the global `authorization` (or `args`) block is evaluated with `read_headers` granted, and a global `response:` decorates the denial. Fail-closed session-store denials carry the response too.
+- **Python bindings (PyO3).** Native `cpex` Python package wrapping the cpex-core `PluginManager`, built with maturin/PyO3. ([#70](https://github.com/contextforge-org/cpex/pull/70))
 
 ### Changed
 
@@ -24,6 +31,8 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
   The two authorization phases may be written either nested under an `authorization:` block or flat directly on the section; the forms are equivalent. The field-pipeline keys `args:` / `result:` are unchanged (they stay aligned with the `args.*` / `result.*` attribute namespaces that predicates and interpolation read). Internal APL IR is unchanged. (#105)
 
+- **Canonical APL config shape in docs.** All documentation, the README, and the bundled examples now use one canonical shape — no `apl:` wrapper, with `authentication:` and `authorization:` as sibling blocks (`pre_invocation:` / `post_invocation:` nested under `authorization:`; `args:` / `result:` / `pdp:` / `session_store:` / `response:` as siblings). Both the `apl:` wrapper and the wrapper-free form remain accepted by the parser; this only standardizes the examples authors copy from.
+
 ## [0.2.0] - 2026-06-26
 
 ### Added
 
@@ -62,7 +62,7 @@ default-members = [
 ]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 # MSRV — keep in sync with rust-toolchain.toml `channel` and clippy.toml `msrv`.
 rust-version = "1.96"
@@ -110,21 +110,21 @@ regex = "1"
 # time cargo substitutes it for the `path`. `cargo release` keeps these in sync
 # with the workspace version. Keys are package names (builtins differ from their
 # directory names), paths are workspace-root-relative.
-cpex-core                     = { path = "crates/cpex-core",                   version = "0.2.0" }
-cpex-orchestration            = { path = "crates/cpex-orchestration",          version = "0.2.0" }
-cpex-sdk                      = { path = "crates/cpex-sdk",                     version = "0.2.0" }
-cpex-builtins                 = { path = "crates/cpex-builtins",               version = "0.2.0", default-features = false }
-apl-core                      = { path = "crates/apl-core",                    version = "0.2.0" }
-apl-cmf                       = { path = "crates/apl-cmf",                      version = "0.2.0" }
-apl-cpex                      = { path = "crates/apl-cpex",                     version = "0.2.0" }
-cpex-plugin-pii-scanner       = { path = "builtins/plugins/pii-scanner",       version = "0.2.0" }
-cpex-plugin-audit-logger      = { path = "builtins/plugins/audit-logger",      version = "0.2.0" }
-cpex-plugin-identity-jwt      = { path = "builtins/plugins/identity-jwt",      version = "0.2.0" }
-cpex-plugin-delegator-oauth   = { path = "builtins/plugins/delegator-oauth",   version = "0.2.0" }
-cpex-plugin-delegator-biscuit = { path = "builtins/plugins/delegator-biscuit", version = "0.2.0" }
-cpex-pdp-cedar-direct         = { path = "builtins/pdps/cedar-direct",         version = "0.2.0" }
-cpex-pdp-cel                  = { path = "builtins/pdps/cel",                   version = "0.2.0" }
-cpex-session-valkey           = { path = "builtins/session/valkey",            version = "0.2.0" }
+cpex-core                     = { path = "crates/cpex-core",                   version = "0.2.1" }
+cpex-orchestration            = { path = "crates/cpex-orchestration",          version = "0.2.1" }
+cpex-sdk                      = { path = "crates/cpex-sdk",                     version = "0.2.1" }
+cpex-builtins                 = { path = "crates/cpex-builtins",               version = "0.2.1", default-features = false }
+apl-core                      = { path = "crates/apl-core",                    version = "0.2.1" }
+apl-cmf                       = { path = "crates/apl-cmf",                      version = "0.2.1" }
+apl-cpex                      = { path = "crates/apl-cpex",                     version = "0.2.1" }
+cpex-plugin-pii-scanner       = { path = "builtins/plugins/pii-scanner",       version = "0.2.1" }
+cpex-plugin-audit-logger      = { path = "builtins/plugins/audit-logger",      version = "0.2.1" }
+cpex-plugin-identity-jwt      = { path = "builtins/plugins/identity-jwt",      version = "0.2.1" }
+cpex-plugin-delegator-oauth   = { path = "builtins/plugins/delegator-oauth",   version = "0.2.1" }
+cpex-plugin-delegator-biscuit = { path = "builtins/plugins/delegator-biscuit", version = "0.2.1" }
+cpex-pdp-cedar-direct         = { path = "builtins/pdps/cedar-direct",         version = "0.2.1" }
+cpex-pdp-cel                  = { path = "builtins/pdps/cel",                   version = "0.2.1" }
+cpex-session-valkey           = { path = "builtins/session/valkey",            version = "0.2.1" }
 
 # Size-first release profile. The FFI artifact (libcpex_ffi.a) is linked
 # statically into host binaries, so its compiled size flows straight into
 
@@ -49,31 +49,34 @@ One policy defines three distinct enforcement pipelines, one for each entity.
 routes:
   # HR lookup: gate on role, scope a downstream token, redact by permission, taint the session.
   - tool: get_compensation
-    pre_invocation:
-      - "require(role.hr)"
-      - "delegate(workday-oauth, target: workday-api, permissions: [read_compensation])"
-      - "taint(secret, session)"
-      - "run(audit-log)"
+    authorization:
+      pre_invocation:
+        - "require(role.hr)"
+        - "delegate(workday-oauth, target: workday-api, permissions: [read_compensation])"
+        - "taint(secret, session)"
+        - "run(audit-log)"
     result:
       ssn: "str | redact(!perm.view_ssn)"
 
   # Repo search: gate on team, decide with CEL (or Cedar), require the scoped grant.
   - tool: search_repos
-    pre_invocation:
-      - "require(team.engineering | team.security)"
-      - cel:
-          expr: "(role.engineer && args.visibility == 'internal') || role.security"
-          on_deny: ["deny('engineers read internal only; security reads any', 'cel.policy_denied')"]
-      - "delegate(github-oauth, target: github-api, permissions: [repo:read:internal])"
-      - "run(audit-log)"
+    authorization:
+      pre_invocation:
+        - "require(team.engineering | team.security)"
+        - cel:
+            expr: "(role.engineer && args.visibility == 'internal') || role.security"
+            on_deny: ["deny('engineers read internal only; security reads any', 'cel.policy_denied')"]
+        - "delegate(github-oauth, target: github-api, permissions: [repo:read:internal])"
+        - "run(audit-log)"
 
   # Outbound email: refuse if the session already touched secret data.
   - tool: send_email
-    pre_invocation:
-      - "require(perm.email_send)"
-      - "run(pii-scan)"
-      - "security.labels contains \"secret\": deny('write-down blocked', 'session_tainted')"
-      - "run(audit-log)"
+    authorization:
+      pre_invocation:
+        - "require(perm.email_send)"
+        - "run(pii-scan)"
+        - "security.labels contains \"secret\": deny('write-down blocked', 'session_tainted')"
+        - "run(audit-log)"
 ```
 
 Two examples illustrate the behavior:
 
@@ -9,13 +9,12 @@
 //
 // ```yaml
 // global:
-//   apl:
-//     pdp:
-//       - kind: cedar-direct
-//         dialect: cedar          # optional, defaults to PdpDialect::Cedar
-//         policy_text: |          # required (or policy_file)
-//           @id("owner-override")
-//           permit(...);
+//   pdp:
+//     - kind: cedar-direct
+//       dialect: cedar          # optional, defaults to PdpDialect::Cedar
+//       policy_text: |          # required (or policy_file)
+//         @id("owner-override")
+//         permit(...);
 // ```
 //
 // Hosts register an instance of this factory in `AplOptions.pdp_factories`;
 
@@ -8,10 +8,9 @@
 //
 // ```yaml
 // global:
-//   apl:
-//     pdp:
-//       - kind: cel
-//         on_error: deny          # optional; deny | allow, default deny
+//   pdp:
+//     - kind: cel
+//       on_error: deny          # optional; deny | allow, default deny
 // ```
 //
 // The CEL expression itself lives in each route's `cel: { expr: "..." }`
 
@@ -4,7 +4,7 @@
 // Authors: Fred Araujo
 //
 // Parses and validates the `global.apl.session_store` block for the
-// Valkey backend. Deliberately minimal (R11): a single endpoint, TLS,
+// Valkey backend. Deliberately minimal: a single endpoint, TLS,
 // auth, key prefix, optional sliding TTL, and fail-closed timeout/retry
 // knobs with committed safe defaults. Sentinel/Cluster fields are NOT
 // present — they are out of scope and would be dead config surface.
@@ -52,17 +52,17 @@ pub struct ValkeyConfig {
     #[serde(default)]
     pub password: Option<String>,
 
-    /// Key prefix/namespace for label keys (R9).
+    /// Key prefix/namespace for label keys.
     #[serde(default = "default_key_prefix")]
     pub key_prefix: String,
 
     /// Sliding TTL in seconds, refreshed on load and append. `None`
-    /// (default) means no expiry (R7).
+    /// (default) means no expiry.
     #[serde(default)]
     pub ttl_seconds: Option<u64>,
 
     /// Declared maximum session-identity lifetime, used only to emit the
-    /// TTL-soundness warning (R17) when `ttl_seconds` is shorter.
+    /// TTL-soundness warning when `ttl_seconds` is shorter.
     #[serde(default)]
     pub max_session_lifetime_seconds: Option<u64>,
 
@@ -90,9 +90,9 @@ impl ValkeyConfig {
     }
 
     /// Enforce the non-negotiable invariants. TLS is mandatory off
-    /// localhost (R10); a `tls: true` + plaintext `redis://` scheme is a
+    /// localhost; a `tls: true` + plaintext `redis://` scheme is a
     /// contradiction (would connect in cleartext); the connection URL
-    /// must build; the TTL-soundness warning (R17) is emitted here.
+    /// must build; the TTL-soundness warning is emitted here.
     ///
     /// All error text routes the endpoint through [`redact_endpoint`] so
     /// embedded credentials never leak into errors or logs.
@@ -152,7 +152,7 @@ impl ValkeyConfig {
                     ttl_seconds = ttl,
                     max_session_lifetime_seconds = life,
                     "valkey session_store TTL is shorter than the declared max session lifetime; \
-                     accumulated taint can silently expire (downgrade-by-waiting) — see R8"
+                     accumulated taint can silently expire (downgrade-by-waiting)"
                 );
             }
         }
 
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // Authors: Fred Araujo
 //
-// Internal connection layer (R14): builds and holds the deadpool-redis
+// Internal connection layer: builds and holds the deadpool-redis
 // pool for the Valkey backend. Kept private to this crate — it is NOT a
 // public reusable API. When a second consumer (the planned OAuth token
 // cache) is actually scheduled, extract a shared layer then
 
@@ -17,7 +17,7 @@ pub enum BuildError {
     #[error("invalid valkey session_store config: {0}")]
     Config(String),
 
-    /// TLS is mandatory for any non-localhost endpoint (R10): session
+    /// TLS is mandatory for any non-localhost endpoint: session
     /// security labels must not transit a network segment in plaintext.
     #[error(
         "valkey session_store requires TLS for non-localhost endpoint '{0}' \