Prepare 0.3.4 with the published dependency graph

Message

Lock published JSON 0.16.2 and MCP 0.18.4 without moving the 0.22.15 runtime family or other dependencies. Record the release date and public build instructions, and describe tool-stream timeout and connection behavior accurately.

Changed

 CHANGELOG.md        |  2 +-
 README.md           |  4 ++--
 docs/shared-http.md | 26 +++++++++++++-------------
 package.sgl         | 12 +++---------
 sigil.lock          | 12 ++++++------
 5 files changed, 25 insertions(+), 31 deletions(-)

Diff

CHANGELOG.mdmodified

@@ -5,7 +5,7 @@ All notable changes to **folio** are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),

and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

−8

## [0.3.4] - Unreleased

## [0.3.4] - 2026-10-25

- Dispatch validated HTTP tool calls in separate cooperative tasks, so a writer waiting on a store lock does not hold up independent reads. Mutating handlers remain serialized through their index flush; existing cross-process file locking is preserved.

- Use a separate HTTP index connection for reads, keeping uncommitted census/write rows private. Concurrent reads can finish before an in-flight write and see its previous committed state. Reads still have per-query SQLite consistency and atomic Markdown files, without a global multi-file snapshot. The 15-second outside-edit census is unchanged.

README.mdmodified

@@ -276,8 +276,8 @@ result line, so a partial failure is visible rather than swallowed.

276

## Development

277

278

Requires [Sigil](https://codeberg.org/sigil/sigil) v0.22.15, sigil-json 0.16.2,

−279

sigil-mcp 0.18.4 and sigil-http 0.18.8. This unreleased branch currently needs

−280

two dependency overrides pending their publication; see

+279

sigil-mcp 0.18.4 and sigil-http 0.18.8. Install the published dependency graph

+280

from the committed lock without redirects; see

281

[dependency status](docs/shared-http.md#development-status) before building.

282

283

```bash

docs/shared-http.mdmodified

@@ -11,8 +11,10 @@ The listener binds only `127.0.0.1`. Clients use `/mcp` with an

`Authorization: Bearer TOKEN` header. The token file must have no group or

other permissions, contain one printable ASCII token of at least 32 characters,

and stay outside client configuration files. Unauthenticated requests return 401

−14

before protocol dispatch. Requests have a five-minute timeout to allow queued

−15

work behind a slow tool. Clients should allow a six-minute tool timeout.

+14

before protocol dispatch. The five-minute HTTP timeout applies to request

+15

parsing and idle connections. Dispatched tool streams leave that timeout

+16

sweep: there is no server-side tool deadline, and a hung tool can hold its

+17

socket indefinitely. Clients should allow a six-minute tool timeout.

`folio/rebuild-index` is refused immediately over HTTP; run explicit full

rebuilds through a separate stdio maintenance session. An initial HTTP start

with an empty or upgraded index can take several minutes before it listens.

@@ -57,8 +59,9 @@ is atomic per file; tools have no global snapshot across files and index queries

Stdio retains one connection and the same cross-process writer coordination.

HTTP tool replies are ordinary JSON-RPC JSON documents sent with chunked

−60

framing. Early validation retains its HTTP errors; an unexpected failure after

−61

response headers are sent becomes a JSON-RPC internal error carrying the same

+62

framing and `Connection: close`, using one connection per tool call with no

+63

pipelining after a `tools/call`. Early validation retains its HTTP errors; an

+64

unexpected failure after response headers are sent becomes a JSON-RPC internal error carrying the same

request id. Clients must consume the complete body before decoding it.

A metadata census runs every 15 seconds, reading content only for changed files.

@@ -82,12 +85,9 @@ process environment; keep only its variable name in generated configuration.

## Development status

−85

The released 0.3.3 dependency graph uses sigil-json 0.16.1, sigil-mcp 0.18.3

−86

and sigil-http 0.18.8. This unreleased 0.3.4 branch additionally requires

−87

sigil-json 0.16.2 (less encoding CPU) and sigil-mcp 0.18.4 (opt-in deferred

−88

tools). Those two library changes are prepared in isolated branches. The lock

−89

still records the released graph pending leader approval to publish them;

−90

this branch is not yet installable from its public lock. Prototype builds use

−91

explicit overrides for those two libraries and retain the pinned 0.22.15

−92

runtime family. Release qualification must refresh the lock and verify the

−93

published dependency graph before installation.

+88

The 0.3.4 lock uses published sigil-json 0.16.2 (less encoding CPU), sigil-mcp

+89

0.18.4 (opt-in deferred tools) and sigil-http 0.18.8, retaining the pinned

+90

0.22.15 runtime family. Release builds and qualification use that public lock

+91

without dependency overrides. `dev-redirects.sgl` is optional development

+92

configuration, active only when explicitly selected through the CLI or

+93

`SIGIL_REDIRECTS`; do not enable it for release qualification.

package.sglmodified

@@ -90,15 +90,9 @@

;; the first release carrying BOTH `url-link` and SD-P7's section-child

;; content profile, which is what `(folio doc reader)` delegates to.

;;

−93

;; The RANGE and the redirect are deliberately unchanged. Whether folio

−94

;; should now pin `^0.1.3` and drop the dev redirect is a dependency

−95

;; decision for merge time, not a change to make underneath a phase that is

−96

;; mid-flight -- and until it is made, the build still resolves this through

−97

;; dev-redirects.sgl to ../sigil-doc, so a green build here remains evidence

−98

;; about a WORKING TREE rather than about a tag. `test/gate-f1b.sh` asserts

−99

;; the CAPABILITY it depends on (the profile constructors are exported)

−100

;; rather than any version, because a version is a proxy and the capability

−101

;; is the thing.

+93

;; The public lock pins sigil-doc 0.1.4, including that released API.

+94

;; Development redirects are optional and explicitly selected; release

+95

;; builds and qualification use the public lock without overrides.

(from-git url: "codeberg:sigil/sigil-doc" version: "^0.1"))

dev-dependencies: (list

sigil.lockmodified

@@ -38,9 +38,9 @@

version: "0.22.15")

(package name: "sigil-json"

url: "codeberg:sigil/sigil-json"

−41

ref: "^0.16.1"

−42

sha: "ef45dbbacac9ab67b7b086cab9f36577fae224f3"

−43

version: "0.16.1")

+41

ref: "^0.16.2"

+42

sha: "1523ffc504043d9a46031708acc11697916b7434"

+43

version: "0.16.2")

(package name: "sigil-log"

url: "codeberg:sigil/sigil-log"

ref: "^0.16.0"

@@ -48,9 +48,9 @@

version: "0.16.0")

(package name: "sigil-mcp"

url: "codeberg:sigil/sigil-mcp"

−51

ref: "^0.18.3"

−52

sha: "fa0e5ac944054777b8d41db5e4425b51a7f351d2"

−53

version: "0.18.3")

+51

ref: "^0.18.4"

+52

sha: "5d1c63ec163a88481904f2dcc5d4bed400209870"

+53

version: "0.18.4")

(package name: "sigil-http"

url: "codeberg:sigil/sigil-http"

ref: "^0.18.8"