Changelog

All notable changes to FlexiQ are documented here. The format is based on Keep a Changelog; the project follows Semantic Versioning. All SDKs (Python, Node, Java) and the underlying Rust crates are released together, in lock-step.

Releases up to and including 0.23.0 were published under the project's former name, Taskito, and their entries below keep that name.

1.0.0

The project is now FlexiQ. This is a rename, not a redesign — no API was added, removed, or changed in behaviour beyond its name — but it is a hard break with no compatibility shims.

Published under new names on every registry: flexiq (PyPI), @byteveda/flexiq (npm), org.byteveda:flexiq (Maven), and flexiq/flexiq-core (crates.io). The former packages receive no further releases.

• Imports move to flexiq / @byteveda/flexiq / org.byteveda.flexiq / flexiq_core, and Java types follow: Taskito → FlexiQ, TaskitoException → FlexiQException.
• Every TASKITO_* environment variable is now FLEXIQ_*, with no fallback.
• The default database moves to ~/.flexiq/flexiq.db; the schema is unchanged.
• Webhook signatures ride in X-Flexiq-Signature, the dashboard token in X-Flexiq-Token, and the session cookie is flexiq_session. The spelling is X-Flexiq-, not X-FlexiQ-, so the name survives the title-casing HTTP clients apply to outgoing headers.
• Django commands become flexiq_worker, flexiq_dashboard, flexiq_info.
• The Helm chart is flexiq-server.

Drain your queue before upgrading. Payload markers changed from __taskito_*__ to __flexiq_*__, so 0.23.x and 1.0.0 workers must not share a database. Full instructions: Migrating to FlexiQ.

0.23.0

Version-skew release. A polyglot deployment can now say which SDK and release each worker runs, and the wire format the SDKs exchange is pinned by golden vectors instead of by convention.

Changed

• BREAKING (Rust core): Storage::register_worker takes a WorkerRegistration struct, and WorkerInfo carries two more fields. Registration was already nine positional arguments under a too_many_arguments allow, so the SDK identity below would have made it eleven. Only direct users of the taskito-core crate are affected — the Python, Node and Java APIs are unchanged.

Added

• Workers record the SDK and release that registered them. sdk and sdk_version land on the workers table (migration 0009_worker_sdk), reach list_workers and /api/workers in every SDK, and render as an SDK column in the dashboard. In a polyglot deployment the registry is the only place an operator can tell a stale worker from a current one without going host by host. A worker registered by an older shell reports null rather than a wrong version.
• Golden wire vectors. contracts/wire-vectors.json pins the payload envelope byte for byte — nine encode vectors and three decode-only ones — and every SDK suite asserts against the same file, so a serializer that drifts fails in its own tests rather than in a mixed deployment.
• A polyglot example. examples/polyglot/ runs a Python producer with Node and Java workers against one jobs table, documenting the two footguns that setup has: every SDK's default serializer is same-language-only, and all three processes must opt into the same codec.
• The taskito facade re-exports the workflow and mesh crates, so a Rust consumer depends on one crate instead of three.

Fixed

• An unparseable per-task rate_limit now raises instead of silently disabling throttling. A typo like "100/mn" parsed to None and dropped the limit with no error, which is precisely the failure the limit exists to prevent; retry_budget already rejected the same mistake.
• CBOR payloads are encoded with definite-length containers in every SDK. One SDK emitted indefinite-length maps, so the same arguments hashed differently across languages and automatic idempotency keys did not match between a producer and a worker written in different languages.

0.22.0

Attach and executor release. taskito-server becomes a standalone binary that schedules for an app written against any SDK, workers attach to it over a shared worker protocol, and an executor side-channel carries progress, logs and middleware toggles back. Namespace scoping is completed across the id-addressed storage APIs, and cross-SDK parity lands the operator admin surface, predicates, retry policy and the full event taxonomy in Node and Java.

Changed

• BREAKING (Python): resource scopes renamed to match the other SDKs. ResourceScope.TASK meant checked out of a bounded pool and REQUEST meant fresh per task — the reverse of what Java and Node call those names, so the same scope="task" code behaved differently per SDK. Python now uses POOLED (was TASK) and TASK (was REQUEST); REQUEST is gone, and scope="request" raises. scope="task" still resolves but now builds per task instead of pooling, so pooled resources must move to scope="pooled" — passing pool_size/pool_min with any other scope now raises, which catches that case.
• Closed-set parameters across the core and all three SDKs take enums instead of bare strings: built-in proxy ids, interception mode, predicate on_false, log-consumer on_error, gate on_timeout, workflow diagram format, fan-out strategy, dispatch order, task-log level, workflow run state, dashboard role, subscription mode, and worker status. Wire and stored values are unchanged, and existing string callers keep working (Java keeps its String overloads, deprecated).
• More closed-set surfaces typed, finishing the sweep above: workflow step condition (WorkflowCondition, Python + Java), storage backend (StorageBackend, Python + Java), interception register_type(strategy=…) (Strategy, Python), and the webhook delivery-log status filter (DeliveryStatus, Python). Same non-breaking contract — a string still works. Internally, Python's workflow tracker and saga orchestrator now compare node/run status against the enums rather than string literals.
• The Node native binding is built on napi 3. An internal upgrade from napi 2 with no change to the published API; the minimum supported Node version stays 20.

Added

• taskito-server: a standalone scheduler, attach listener and dashboard. One Rust binary runs the scheduler loop and serves the dashboard for an app written against any SDK, so the fat application image no longer has to be redeployed as a worker. Workers attach to it over a shared worker protocol — a JSON header line plus raw payload bytes, one format for both the prefork pipe and the attach socket — dispatched through a RemoteDispatcher in the core. Database credentials stay in the server rather than the app image.

• A taskito executor subcommand in every SDK. Python, Node and Java each ship an executor that attaches to a running server, advertises the tasks it can run, and executes only those — the process side of the attach topology above.

• An executor side-channel for progress, logs and middleware toggles. An attached executor reports update_progress, task logs, and middleware enable/disable back over the same connection, so an attached worker is observable and controllable exactly like an in-process one. Implemented in the core and wired through all three SDKs.

• A Helm chart for taskito-server, with annotation-driven sidecar injection. deploy/helm/taskito-server installs the scheduler, dashboard and injector as one release, and refuses to render the combinations the server rejects at boot — an attach listener with no token, an unauthenticated dashboard — naming the value to fix instead of leaving a CrashLoopBackOff. With webhook.enabled=true, annotating a pod with taskito.dev/inject adds an executor sidecar built from the pod's own image, so nothing new is pulled and the pattern works for any language. The webhook serves a chart-generated certificate by default, or cert-manager's.

• taskito-server ships as a container image. docker/scheduler.Dockerfile builds a distroless image around a static binary — no libc and no interpreter, with Postgres and Redis compiled in — published as a linux/amd64 + linux/arm64 manifest at ghcr.io/byteveda/taskito-server. One image schedules for apps written against any SDK, so the fat application image no longer has to be duplicated for a worker deployment.

• Java operator admin surface. taskito.requeueJob(id) forces a stuck running job back to pending and releases its execution claim, preserving the retry budget — the only recovery path for a job that neither the timeout reaper nor orphan recovery will touch (use it only once the owning worker is confirmed dead or hung, or the job can run twice). Alongside it: taskito.reloadResources(names) hot-reloads resources built with withReloadable(true), rebuilding dependencies before the resources that used them; taskito.predicateStats() reports what the enqueue gates decided; taskito.analyzeArguments(taskName, payload) dry-runs the interceptor chain without enqueuing; and taskito.shutdown() closes every worker started from the client, so a shutdown hook no longer has to hold each Worker.

• Node operator admin surface. queue.requeueJob(id) forces a stuck running job back to pending and releases its execution claim, preserving the retry budget — the only recovery path for a job that neither the timeout reaper nor orphan recovery will touch (use it only once the owning worker is confirmed dead or hung, or the job can run twice). Alongside it: queue.reloadResources(names?) hot-reloads resources marked reloadable, rebuilding dependencies before the resources that used them; queue.analyzeArguments(taskName, args) dry-runs the interceptor chain without enqueuing or moving interceptionStats(); and queue.shutdown() stops every worker started from the queue, so a SIGTERM handler no longer has to hold each Worker.

• Node predicate recipes, decisions, and registry. A gate could only allow or reject; it can now return a Decision that also skips (no job — queue.tryEnqueue() reports null, enqueue throws the new EnqueueSkippedError) or defers (job created with the gate's delay). Nine ready-made gates ship as Recipes: businessHours, timeWindow, dayOfWeek, isWeekend, after, before, payloadMatches, featureFlag, envVarTruthy — time zones resolved through Intl, so no new dependency, and DST-correct. Gates can be registered by name (registerPredicate) and referenced as gate(task, "name") for config-driven gating, queue.predicateStats() reports what they decided, and predicate.skipped / predicate.deferred join predicate.rejected on the event bus.

• Node producer-side batch accumulator. queue.batcher(task, { maxSize, maxWaitMs }) buffers one-at-a-time enqueues and flushes them as a single enqueueMany call on a size or time trigger — the counterpart of Python's BatchAccumulator and Java's Batcher<T>. Entries keep their own args and EnqueueOptions, a failed flush keeps them buffered (and a timed one retries, reporting to onError), and Symbol.dispose means using flushes the tail at block exit.

• Node bare-metal autoscaler. serveAutoscaler(queue, { app }) and taskito autoscale <app> spawn and drain worker processes to track queue depth on hosts without Kubernetes, closing the last scaling gap against Python's AutoscaleController. Same HPA-shaped formula — depth and utilisation signals, per-direction stabilisation windows, a tolerance band — plus crash replacement, and concurrencyPerWorker is applied to the workers it spawns rather than merely declared. Autoscaler, computeDesiredWorkers, and WorkerProcessManager are exported for embedding.

• Node request resource scope. A fresh instance on every useResource() call, each disposed when the task ends — matching the Java scope of the same name.

• Pub/sub backlog stats in the Node and Java SDKs. queue.topicStats(topic?) (Node) and topicStats() / topicStats(topic) (Java) return the per-subscription snapshot Python has as topic_stats(): pending, running, dead, and oldestPendingAgeMs, with a row for every registered subscription even at zero backlog.

• Job outcome events report how long the task ran: durationMs() on Java's OutcomeEvent, durationMs on Node's, and duration_ms on Python's job event payloads. Java also gains NodeSnapshot.durationMs() / compensationDurationMs() and TaskContext.elapsedMs().

• Full lifecycle event taxonomy in the Node and Java SDKs. Both grow from the 4 job-outcome events to the 29-event cross-SDK taxonomy: enqueue, per-attempt failure (job.failed), worker lifecycle, queue pause/resume, workflow submit/terminal/gate, saga compensation, and predicate rejection. Node types queue.on() per event name (EventMap); Java adds queue-level taskito.onEvent(EventName, Consumer<TaskitoEvent>) with typed event records alongside the unchanged worker-scoped Worker.Builder.on(...). Webhooks can subscribe to every event name. predicate.cancelled is reserved in all three — subscribable, typed and webhook-matchable — but only Python emits it: Node and Java gate at enqueue, where a terminal skip is predicate.skipped because no job exists yet.

• Java webhook deliveries use the dotted wire names. Bodies that previously said "event": "success" now say "event": "job.completed"; stored subscriptions with the legacy four names keep matching, and job-outcome bodies gain duration_ms.

• Retention dry-run. dry_run_retention() reports what a purge would delete right now — per table and in total, against the windows the elected cleaner actually published — so a window can be sized before it deletes anything. The dashboard echoes those live windows rather than guessing at the defaults.

• Retry predicates in the Node and Java SDKs. A per-task retryOn classifies a thrown error: return false and the job dead-letters immediately, whatever retry budget is left. One predicate covers both directions — test for the errors worth retrying, or negate a test for the permanent ones. Java can signal the same intent by exception type instead, via RetryableException / NonRetryableException, so a domain hierarchy doubles as the policy.

• Push-dispatch in the Node and Java shells. Both accept the pushDispatch option, so an enqueue wakes the scheduler immediately instead of waiting out the poll interval.

• Node standalone health and readiness helpers. Liveness and readiness checks that run without the dashboard, for a worker deployment that serves no HTTP of its own.

• Python periodic-schedule catalog management. list_periodic(), delete_periodic(name), pause_periodic(name) and resume_periodic(name) operate the cron catalog at runtime, so a schedule can be suspended or dropped without a redeploy.

• Java classifier jars and GraalVM metadata. Per-platform classifier artifacts publish alongside the fat jar, and bundled reachability metadata makes the SDK usable from a GraalVM native image.

Fixed

• A readiness probe that can actually run. /readiness is gated alongside /metrics, so a Kubernetes probe — which carries no credential, and cannot be given one, since a probe header is a literal string in the manifest — got 401 and the pod never went Ready. TASKITO_DASHBOARD_PUBLIC_READINESS=1 answers that one route without a credential; /metrics stays gated. The Helm chart sets it by default and probes /readiness; turn it off and readiness falls back to /health.

• The attach socket admits a shared group. bind left it at the umask-derived 0755, which denies the group write — and connect(2) needs write — so only the binding uid could attach. It is now chmodded to 0660, which is what makes a same-pod attach configurable: two containers can be given a shared fsGroup, where matching uids is rarely practical.

• Node worker.stop() is awaitable. It now returns a promise that resolves once worker-scoped resources have been disposed, instead of firing that teardown and returning. Dispatch, the heartbeat and log consumers still halt synchronously, so callers that ignore the result behave exactly as before.

• Node event listeners that throw or reject are logged at debug rather than silently swallowed; sibling listeners stay isolated from the failure as before.

• Postgres segfault on process exit. The connection pool opens connections on background threads that can still be running libpq/OpenSSL when the process exits, racing OpenSSL's default atexit teardown. Taskito now initializes OpenSSL itself with that teardown suppressed (OPENSSL_INIT_NO_ATEXIT) before the first Postgres connection.

• Namespace scoping is complete across the id-addressed storage APIs. Every method that addresses a row by id now takes the namespace it must match, so one tenant can no longer read, mutate or complete another's job by guessing its id. Cross-namespace dependencies are rejected at enqueue, and workflow runs are scoped through the store handle.

• Dashboard settings are compare-and-set in every SDK. Two dashboards editing the same JSON settings document no longer silently overwrite each other; a stale write is rejected instead of clobbering the newer one.

• The predicate event taxonomy is complete across SDKs. The gate outcome names each SDK recognized diverged, so a webhook subscribed to one could not be registered against another. All three now carry the same set. Separately, workflow.submitted fires on run submission rather than staying dormant.

• Java null-safety contract and native platform coverage. Nullability is declared across the public API, and the published artifact carries every supported platform's native library rather than only the build host's. JobRec reads are guarded by the backend monitor, and the build no longer silently disables every compile task.

• The Redis task-metric retention purge is bounded. It read its whole below-cutoff window in one ZRANGEBYSCORE and issued a GET per id, so the first sweep after a long retention gap stalled the maintenance tick. It now drains in batches like every other purge, with one MGET per batch.

• Batch enqueue applies unique_key dedup. A batch carrying any keyed entry now routes through the unique path rather than the plain multi-row insert, which would hit the partial unique index and fail the whole batch the moment a key duplicated an active job. Shared by the Node and Java batch enqueues; a keyless batch keeps the chunked throughput path, and Python still batch-inserts without dedup.

• Version drift in the Node CLI banner and the Java installation docs.

0.21.0

Overload-controls and retention release. The queue gains admission and load-shedding controls, retention runs by default with elected cleaners, an opt-in log/cursor pub/sub model lands, and taskito-core is prepared for standalone publication. Cross-SDK parity work and Node webhook hardening round it out.

Added

• Log + cursor pub/sub. An opt-in log topic mode writes one message row per publish (O(1)) and is consumed by pull — read, process, then ack — with per-message acknowledgement, a first-class topic registry, and a managed consumer that tracks cursors for you.
• Retention, on by default. Per-table retention windows purge aged job, dead-letter, and archived rows. A single reaper and retention cleaner are elected across workers so the sweep runs once, and every purge is bounded on all three backends.
• Overload controls. An opt-in max_pending admission cap rejects enqueues past a ceiling, opt-in CoDel load shedding drops work that has dwelled too long, and an opt-in LIFO dispatch order serves newest-first.
• Retry budget. A per-task token-bucket retry_budget caps how fast a task may retry, independently of max_retries.
• Native async dispatch. Coroutine tasks run on a native async executor, with worker drain decoupled from Python reference counts.
• taskito-tui. A headless terminal UI crate inspects and operates a queue directly against its database, with no changes to the core.
• Native Rust worker. A native worker with a task registry and dispatcher, plus typed Redis and JSON error variants, as part of readying taskito-core for standalone use.
• Cross-SDK parity. Node and Java gain per-task policy and batching parity; the remaining parity gaps are tracked explicitly.
• Single-source release version. One version literal in the root manifest drives every SDK, checked in CI so a mismatched manifest fails the build.

Changed

• Scale to millions of rows. Keyset pagination and bounded scans replace offset paging and full scans across listings and mass mutations.
• Async backpressure. In-flight work is bounded to the pool's worker and async concurrency, so async pools no longer over-claim.
• One task lifecycle. Synchronous and native-async dispatch share a single task-lifecycle path in Python.
• Retention tuning. PostgreSQL fillfactor and autovacuum are tuned for the retention workload, and the Redis archived-retention purge is bounded.

Fixed

• Node webhook SSRF guard. Webhook delivery screens loopback, private, link-local, and cloud-metadata targets at registration and re-checks every attempt; redirects are not followed.
• Node webhook store. Subscriptions persist in the shared cross-SDK layout, so a hook registered by any SDK is visible to all of them.
• Node log consumers flush when subscriptions are declared and stop earlier on worker shutdown.
• Negative result_ttl is rejected rather than silently accepted (Python).
• Documentation is served under /taskito without a doubled path prefix.

0.20.0

Scaling release: the queue survives higher task ingest/dispatch and pub/sub fan-out rates, and schema management moves to code-first migrations. Worker dispatch now respects each pool's execution capacity, so a worker no longer claims more than it can run and starve its peers.

Added

• Code-first migrations. All schema DDL is built programmatically with sea-query (no raw SQL) and applied by a versioned migrator with path-based auto-discovery — dropping a migrations/mXXXX_*.rs file registers it automatically. Migration recording is atomic and idempotent, so concurrent startups and interruptions are safe. New scaling indexes ship as part of the baseline.
• Batching. Keyed pub/sub fan-out is committed in a single transaction, Redis subscription reads are pipelined to constant round trips, execution claims are taken per batch, and successful results are finalized together — cutting round trips under load across all SDKs.
• Bounded in-flight dispatch. A scheduler now caps how many jobs it keeps in flight at the worker pool's execution parallelism, freeing a slot (and refilling immediately) as each job finishes.

Changed

• Drain-until-empty polling. Each poll wake dispatches all ready work instead of one job per tick, removing the throughput ceiling imposed by the poll interval.
• Jittered backoff. Retry backoff uses full jitter, and the poller's gate-reschedule delays are jittered, to avoid retry stampedes.
• Topic fan-out releases the GIL during publish/reap/backlog work (Python).

Fixed

• Worker fairness. Under drain-until-empty, one worker could claim a whole backlog and strand it Running on itself while peers sharing the database sat idle; in-flight dispatch is now bounded to the pool size.
• Workflow step double-execution. A step now honors the task's max_retries, and the tracker reacts only to a node's terminal job failure — closing an exactly-once violation under load.
• Jobs stranded by a transient claim error return to Pending immediately rather than waiting out the stale-job reaper.
• Postgres batch claims run in one transaction (no partially-committed claims on error).

0.19.0

Parity release: the Java SDK reaches feature parity with the other SDKs (and its baseline moves to Java 17), payload codecs land as a cross-SDK wire contract, and the resource system gains a bounded pooled scope plus health-check-driven recreation. One breaking change in the Node SDK: scan-heavy queue methods now return Promises.

Added

• Java SDK full parity. Workflows grow gates, conditional steps, sub-workflows, sagas, incremental caching, analysis/visualization, and canvas shortcuts. New: worker resource dependency injection with five scopes (worker / thread / task / request / pooled), enqueue predicates and interception, two-sided payload codecs with per-task annotations, signed resource proxies with expiry/purpose binding and sessions, producer-side batching, in-process autoscaling plus a scaler HTTP endpoint, an optional MessagePack serializer, observability middleware, a Spring Boot 3 starter, a mesh scheduling worker, and a Panama FFM fast-path for hot byte operations. Maven Central publishing is automated end to end.
• Payload codecs (all SDKs). A codec chain (gzip, AES-GCM, HMAC) that wraps the queue serializer on both the enqueue and result paths — configurable globally or per task via a named registry. The wire format is a cross-SDK contract: payloads encoded by one SDK decode in any other. Dedup keys hash pre-codec bytes, so encryption does not break idempotency.
• Pooled resource scope (Node + Java). A bounded checkout/return pool per resource: each task checks out one instance for its duration and returns it at task end. Capacity, prewarm, acquire timeout, and max lifetime are configurable; instances are disposed at worker shutdown or lifetime expiry.
• Node resource health checks. Per-resource healthCheck with automatic recreation and a terminal unhealthy state after the recreation budget is spent. The worker heartbeat now carries per-resource health, surfaced through listWorkers().
• Node proxy system. Signed proxy references with a file handler (HMAC-SHA256 over a canonical JSON form, path allowlists, TTL and purpose binding), plus proxy sessions with identity dedup on deconstruct, signature-keyed memoization on reconstruct (re-verified on every resolve), and LIFO cleanup on close.
• Node enqueue interceptors. Pass / convert / redirect / reject rules that run before defaults, middleware, and serialization — same model as the other SDKs.
• Java THREAD and REQUEST resource scopes, completing the scope matrix alongside worker, task, and pooled.

Changed

• Node (breaking): scan-heavy queue methods are now async. stats*, listJobs, deadLetters*, purge*, listWorkers, getMetrics, and getJobErrors return Promises and no longer block the event loop; webhook Delivery was reshaped to the dashboard contract.
• Java baseline is now 17 (previously 11).

Fixed

• Python results always use the queue serializer. Task results were serialized with raw cloudpickle on three of the four write paths while reads went through the configured serializer; all result writes now route through the queue serializer (with a legacy fallback so old results stay readable).
• Node workflow tracker correctness (static-successor cascade on managed runs, fan-out sibling successors — both also fixed in Python), plus cursor-based task-log streaming.

0.18.0

Reliability and storage release: Postgres dequeues with SKIP LOCKED, crashed workers' in-flight jobs are recovered within ~30s instead of waiting their full timeout, and the dead-letter and filter paths are indexed. The internal job_payloads side table was removed (payloads inline again). No public API or wire-format change.

Changed

• Storage dequeue hardening. Postgres now dequeues with FOR UPDATE SKIP LOCKED, so concurrent workers claim disjoint jobs instead of all scanning the same candidates and racing on the claim. dequeue_batch no longer reads payload blobs during its candidate scan, and expired batch candidates are archived instead of left stranded in the live table. No API or wire change.

Added

• Fast in-flight recovery on worker death. When a worker process crashes mid-job, a surviving worker now requeues its Running jobs within ~30s of the missed heartbeat (via retry / dead-letter) instead of waiting the job's full timeout. The scheduler claims execution under its real worker_id and a new maintenance step reclaims orphaned claims atomically, so concurrent survivors never double-rescue. Works across Python, Node, and Java; SQLite/Postgres/Redis. No API change.
• Indexes for dead-letter and filter paths. dead_letter (previously unindexed) gains indexes on failed_at and task_name; jobs gains (task_name, status) and partial indexes on expires_at / namespace; archived_jobs gains created_at and namespace. Keeps DLQ, listing, and maintenance queries flat as tables grow.

Removed

• job_payloads side table. Reverted the 0.15 payload side table — payload and result live inline on jobs/archived_jobs again. The narrow dequeue scan already excludes the blobs by column selection (Postgres TOAST / SQLite overflow keep them off the scanned pages), so the side table bought nothing. It is dropped on migration; the inline columns were never removed, so no data moves.

0.17.0

Feature release across the SDKs: periodic-task management, task-scoped dead-letter queries, and the first Java SDK release.

Added

• Java SDK. First release, published to Maven Central as org.byteveda:taskito. A JNI binding over the Taskito core with the full producer / worker / inspection / admin surface, workflows, distributed locks, periodic tasks, an in-memory taskito-test backend, and a @TaskHandler annotation processor. Verified under GraalVM native-image.
• Periodic task management. List, unschedule, pause, and resume registered cron tasks — listPeriodic / deletePeriodic / pausePeriodic / resumePeriodic (Java, Node) and the equivalent native bindings (Python). Pause toggles the task's enabled flag without removing it (#313).
• Per-task dead-letter queries. List and purge dead-letter entries scoped to a single task — listDeadByTask / purgeDeadByTask (Java), deadLettersByTask / purgeDeadByTask (Node), and native bindings (Python). Filtering happens server-side so pagination stays correct (#314).
• Per-task retry backoff (Java). Task.retryPolicy(...) surfaces the core retry engine's backoff curve — exponential with jitter, or exact explicit delays — with the retry budget still set per enqueue (#311).

Changed

• Node now requires Node.js 20+. Node 18 reached end-of-life; the test toolchain (vitest 4) requires Node 20.12+. The engines floor and tsup target were raised accordingly (#312).

0.16.4

Maintenance release. Upgrades the Rust↔Python binding layer and refreshes project docs; no public API changes.

Changed

• PyO3 0.29. Upgraded the PyO3 binding layer from 0.22 to 0.29 (and pyo3-log to 0.13). Internal only — no Python API change. Migrates to the Bound / IntoPyObject APIs and declares gil_used, laying the groundwork for Python 3.14 and free-threaded builds.
• Node SDK default SQLite settings. Opening a SQLite-backed queue now applies sensible defaults out of the box (#292).
• Documentation. Restructured the READMEs into a project-level root README plus self-contained per-SDK pages, and introduced this root CHANGELOG.md — now also rendered on the documentation site.

0.16.3

Reliability patch — correctness fixes across the scheduler and storage layer, plus the missing Django admin templates. No API changes.

Fixed

• Django admin templates. The taskito.contrib.django admin views shipped without their templates, so every admin page raised TemplateDoesNotExist. The templates are now authored and packaged, and the integration guide documents the required taskito.contrib.django entry in INSTALLED_APPS.
• At-most-once retries. An explicit per-call max_retries=0 is no longer overridden by the task-policy default, so a no-retry job is no longer re-executed up to the policy limit.
• Unique enqueue. enqueue_unique now validates dependencies inside the transaction — a missing dependency no longer runs the job and a dead/cancelled dependency no longer strands it Pending — and never returns a phantom (rolled-back) job under unique-key contention.
• Dead-letter policy. DLQ auto-retry is scoped to the worker's namespace and served queues (no longer resurrecting other workers' entries); per-entry and per-job result TTLs are purged even without a global result_ttl; and job metadata survives the dead-letter round trip.
• SQLite transaction safety. Read-then-write operations (dequeue, enqueue, rate-limit) use immediate write-priority transactions, avoiding SQLITE_BUSY deadlocks; migration ALTER TABLE failures now propagate instead of being downgraded to warnings.
• Postgres rate limiting. The rate-limit row is seeded and locked FOR UPDATE, preventing concurrent workers from over-admitting beyond the configured limit.

0.16.2

Reliability patch — correctness fixes across the scheduler, dashboard, and Redis backend. No API changes.

Fixed

• Scheduler retry budget. Soft-gate reschedules (rate limit, circuit breaker, concurrency cap, channel backpressure) no longer consume a job's retry budget; a job that never executed is rescheduled without incrementing retry_count, so it is no longer dead-lettered early on its first real failure.
• Webhook secrets. Webhook signing secrets and delivery logs (stored under webhooks: keys) are no longer readable through GET /api/settings.
• Structured notes. The dashboard job detail page no longer crashes on jobs with notes (the API now emits notes as a canonical JSON string), and non-finite floats (NaN/Infinity) are rejected at enqueue instead of producing invalid JSON that broke the jobs API.
• Redis write-path atomicity. Closed a cluster of races in the Redis backend: the dequeue claim is now an atomic compare-and-set (a cancelled/expired job can no longer be resurrected and executed); retry/reschedule requeue atomically (no stranded jobs); complete and purge release the unique-key pointer with a compare-and-delete (no clobbering a reused key); progress/cancel writes are guarded against resurrecting an archived job; and the dead-letter move commits the DLQ entry and the archive together.

0.16.1

Patch release with no user-facing changes.

0.16.0

Feature release: mesh scheduling, DLQ policies, and a full dashboard redesign.

Added

• Mesh scheduling. Decentralized worker overlay network for task affinity and work-stealing. SWIM gossip protocol for peer discovery, consistent-hash ring for affinity routing, TCP work-stealing for load balancing. New taskito-mesh crate (feature-gated via mesh). Python API: MeshWorker class passed to queue.run_worker(mesh=...). The database remains source of truth — mesh is a dispatch optimization only.
• DLQ policies. Dead-letter queue entries now support auto-retry, per-entry TTL, and explicit delete. New Queue params: dlq_auto_retry_delay and dlq_auto_retry_max. New methods: delete_dead() / adelete_dead(). Storage trait gains delete_dead, purge_dead_with_ttl, and list_dead_for_retry across all three backends. Dashboard adds a Discard button and retry-count badge on the Dead Letters page.
• Dashboard "Friendly ops" redesign. Full re-skin with warm-paper neutrals, emerald accent, and IBM Plex typography. New shared primitives: Switch, QueueBar, MeterBar, Segmented, Stepper, KvList, Callout, LiveDot, StatusBadge. Overview page gains a health pulse banner, workers card, and busiest-queues table. All pages restyled. Light/dark toggle preserved; custom accent override via useApplyAccent.
• Dashboard workflows module. Workflows page with routes and nav entry; command palette entries for Tasks, Webhooks, and Settings.
• Dashboard change-password dialog in the user menu.

Fixed

• OAuth callback errors redirect to login instead of showing a raw error page. Missing joserfc dependency added to the oauth extras group.
• Dashboard timestamp contract enforced. Webhook store, overrides store, and auth endpoints now emit Unix milliseconds (matching the documented API contract) instead of seconds — fixes "56 years ago" display bugs.
• Dashboard sidebar health derived from stats query, no longer hardcoded green.
• Dashboard sidebar polls at configured interval on all pages, preventing stale "Updated Xs ago" timers.
• Fixed sidebar scrolls independently of page content.
• Dead code removed from dashboard (QueueBreakdown, formatBytes, unused webhook queries).
• Consistent vertical spacing across all dashboard pages.
• Workers card shows overflow count ("+N more" link when >6 workers).
• Accessibility improvements. prefers-reduced-motion honored for animations; aria-live on Stepper value changes; aria-pressed on live-tail toggle; accessible name on tasks search input.

Changed

• Dashboard dependencies updated (22 packages in the dashboard-deps group).

Notes

• jobs.payload and jobs.result columns (dual-written since 0.15.0 for rollback safety) are not dropped in this release. They remain for one more cycle to give any lagging workers time to upgrade. Expect removal in 0.17.

0.15.2

Security-hardening release. No breaking changes.

Added

• SignedSerializer. Opt-in HMAC-SHA256 integrity wrapper for task payloads and results — a worker refuses to deserialize bytes not produced with the shared key, closing the untrusted-storage code-execution path. Compose with EncryptedSerializer for confidentiality + integrity.
• Queue.max_payload_bytes. Per-queue cap (default 1 MiB) that rejects oversized serialized payloads at enqueue time.
• Security guide. New Operations → Security page documenting the trust model and a production hardening checklist.

Changed

• Dashboard authorization is enforced server-side. Mutating API routes now require the admin role; viewer sessions are read-only. Session and CSRF cookies carry Secure, and /metrics / /readiness can be gated behind TASKITO_DASHBOARD_METRICS_TOKEN.
• Scaler binds to 127.0.0.1 by default. Use --host 0.0.0.0 only behind a trusted network boundary.

Fixed

• Settings API no longer leaks auth data. /api/settings hides and rejects internal auth: keys (password hashes, sessions, CSRF secret).
• Webhook SSRF closed. Target URLs are re-validated against private/loopback/metadata addresses at delivery time (defeating DNS rebinding) and redirects are no longer followed.
• Proxy hardening. File-proxy allowlist prefix/symlink bypass closed; argument reconstruction restricted to safe type kinds; a warning is emitted when proxy recipes are reconstructed without a signing key.
• Lock owner token no longer disclosed. DistributedLock.info() masks another holder's owner_id; Redis locks set a native TTL with an atomic reap.
• No duplicate execution on claim errors. The scheduler skips dispatch when a claim attempt errors instead of running the job unguarded.
• Job-list API summarizes tracebacks. Only the final exception line is shown in the jobs list; the full traceback stays on the per-job errors endpoint.

0.15.1

Fixed

• Mobile navigation drawer closes on navigation. The drawer previously stayed open after tapping a link; it now closes on every navigation, including re-selecting the current route.
• Mobile menu shows the full navigation. The Tasks and Webhooks links were missing from the mobile menu. The sidebar and mobile menu now share a single navigation definition so the two can no longer drift.
• Job logs tab virtualized. The job detail logs view renders only the visible rows, keeping jobs with hundreds of log lines smooth to scroll.
• Resources table loading state matches its layout. The placeholder now uses the table-shaped skeleton instead of a single opaque block.

0.15.0

See the Upgrading to 0.15 guide for migration steps, rolling-upgrade notes, and the downgrade floor.

Breaking

• Serializer default changed to SmartSerializer. Payloads written by 0.15 carry a 1-byte codec tag and cannot be read by pre-0.15 workers. Upgrade all workers together; if rolling deployment is required, pin Queue(serializer=CloudpickleSerializer()) until every worker is on 0.15. Reading old (untagged cloudpickle) payloads is fully backward compatible.
• Terminal jobs archived immediately. Completed, failed, dead-lettered, and cancelled jobs move to archived_jobs on completion. Pre-0.15 binaries only look in jobs and will not see archived rows — treat 0.15 as a minimum-version floor for any upgraded database.

Added

• SmartSerializer (new default). msgpack for plain-data payloads (faster, smaller); cloudpickle fallback for lambdas, closures, and custom classes. msgpack is now a base dependency. Tuples are preserved; namedtuples fall back to cloudpickle.
• Queue(scheduler_batch_size=N). New optional kwarg; defaults to 1 (unchanged behaviour). Raise it to claim up to N jobs per scheduler round-trip for higher throughput under sustained load.
• Opt-in push-based dispatch (push_dispatch=True). Event-driven wakeups instead of polling — removes the dispatch latency floor and idle DB load. Off by default; requires building the extension with --features push-dispatch (not included in the default wheel). SQLite and Redis are fully event-driven; Postgres falls back to a faster poll pending a native LISTEN listener.

Changed

• Per-task / per-queue stats computed server-side. Replaces O(N) full scans with SINTERCARD. No API change, no data migration.
• Job payloads moved to job_payloads side table. The dequeue path no longer loads payload BLOBs for candidates it does not claim. Transparent — no API change. jobs.payload / jobs.result are dual-written in 0.15 for rollback safety and will be dropped in 0.16. Redis is unaffected.

0.14.2

Fixed

• wait() no longer returns transient FAILED during saga startup. WorkflowRun.wait()'s poll safety-net could observe the run in Failed state before the saga orchestrator transitioned it to Compensating. When a tracker event is registered but has not yet fired, wait() now defers to the event instead of returning the possibly-transient terminal state. The event is set only after the saga decision is fully resolved, so wait() can never prematurely return Failed for a run that is about to compensate.
• _mark_run_compensating retries on transient SQLite lock. The Failed → Compensating storage write could silently fail under SQLite file contention, leaving the run stuck in Failed. The method now retries up to 5 times with backoff, matching the existing retry pattern in compensation job dispatch.

0.14.1

Fixed

• Saga compensation race on Windows SQLite. start_compensation transitioned the workflow run from Failed to Compensating only after a storage I/O call (get_base_run_node_data) that could be slow under SQLite file contention — especially on Windows. During that gap, WorkflowRun.wait()'s poll loop could observe the transient Failed state (which is terminal) and return early, before the saga had a chance to run. The Compensating transition now happens immediately after the cheap in-memory eligibility check, closing the race window. A vacuous-compensation edge case (eligible but no nodes to undo) is handled by finalising as Compensated immediately and resolving any pending parent saga node inline.

0.14.0

Added

• Bare-metal autoscaler. taskito.autoscale provides an in-process HPA-style control loop that spawns and drains taskito worker subprocesses based on queue depth and utilisation. Mirrors the Kubernetes HPA dual-signal formula (depth_desired + util_desired). Configurable stabilisation windows (default: scale-up immediate, scale-down 5 minutes), tolerance band (10%), overload override, and crash recovery. Use serve_autoscaler(queue, AutoscaleConfig(...)) as the entry point. See the Bare-Metal Autoscaler guide.
• Dashboard /api/workflows backend. Four new REST endpoints expose workflow run data: GET /api/workflows/runs (paginated list, filterable by definition name and state), GET /api/workflows/runs/{id} (run header + per-node detail with compensation fields), GET /api/workflows/runs/{id}/dag (DAG JSON), and GET /api/workflows/runs/{id}/children (sub-workflow runs). All timestamps are Unix milliseconds.
• Canvas saga compensation. chain, group, and chord support .with_compensation([...]). On failure, compensators for completed steps are enqueued with a deterministic canvas_compensation:{run_id}:{slot} idempotency key. Dispatch order: chain → reverse-sequential, group → parallel, chord → callback compensator first then group members. Signature.with_compensation(compensator) lets individual signatures carry their own compensator.
• Per-item batch results. @queue.task(batch={"per_item_results": True}) enables per-item tracking for batched tasks. The task returns list[BatchItemResult]; each caller's BatchedJobResult.result() returns only that caller's value. BatchItemResult.success(item_index, result) and BatchItemResult.failure(item_index, error) are the constructors. partial_failures() returns failed items after a successful batch. BatchPartialFailureError and BatchResultTypeError are the new exception types. Cannot be combined with idempotent=True.
• Saga compensate_on_continue. Workflow(on_failure="continue", compensate_on_continue=True) triggers compensation after a continue-mode run terminates with failures. The run transitions through CompletedWithFailures before entering Compensating, then ends in Compensated or CompensationFailed. Without the flag, continue-mode runs end in CompletedWithFailures with no compensation.
• COMPLETED_WITH_FAILURES workflow state. New WorkflowState variant for on_failure="continue" runs that finished with at least one step failure. Emits WORKFLOW_COMPLETED_WITH_FAILURES event. Accessible as "completed_with_failures" in the REST API state field.

0.13.0

Added

• Workflow PostgreSQL backend. WorkflowPostgresStorage mirrors the SQLite implementation through the shared impl_workflow_diesel_ops! macro. Workflows now run on Postgres-backed queues — the previous PyRuntimeError on non-SQLite backends is gone.
• Workflow Redis backend. WorkflowRedisStorage (in crates/taskito-workflows/src/redis_store.rs) stores definitions, runs, and nodes as hashes under a wf: prefix, with sorted-set indexes for state/definition lookup and a Lua FINALIZE_FAN_OUT script for atomic fan-in CAS.
• Multi-backend workflow contract suite (crates/taskito-workflows/tests/storage_contract.rs). 27 cases run against every workflow backend. CI now verifies parity on every PR for SQLite, PostgreSQL, and Redis.
• @queue.task(batch=...). Producer-side task batching collects per-call items in memory and dispatches them as a single job whose payload is the list. Tunable max_size / max_wait_ms. See /docs/guides/core/batching.
• Saga compensation. @queue.task(compensates=...) and Workflow.step(..., compensates=...) declare a compensator. On forward failure (in fail_fast mode) taskito runs the registered compensators in reverse topological order, with idempotency guaranteed via compensation:{run_id}:{node_name} dedup keys. New workflow states: Compensating, Compensated, CompensationFailed. See /docs/guides/workflows/sagas.
• Compensator contract fully wired. Compensators now receive populated (forward_args, forward_kwargs, forward_result) for both deferred and static workflow nodes. current_compensation_context() returns a populated CompensationContext inside compensator bodies (workflow run id, node name, forward job id, forward result).
• Sub-workflow saga propagation. When a parent workflow's saga reaches a sub-workflow node whose child run has its own compensators, compensation propagates into the child. Child saga runs to completion, then the parent node is marked accordingly and the parent's wave advances. Depth-capped at 10 levels to prevent runaway recursion.
• Saga examples + API reference. /docs/more/examples/saga-checkout, /docs/more/examples/batch-emails, /docs/api-reference/saga, /docs/api-reference/batching.

Fixed

• Atomic fan-out node creation. expand_fan_out now uses the transactional create_workflow_nodes_batch to insert all child workflow nodes in one transaction. A crash partway through fan-out expansion no longer leaves half-tracked children.
• Diesel ?-placeholder rewriting for Postgres. sql_query does not auto-rewrite ? → $N for PostgreSQL; the workflow crate's macro now does it explicitly via the pg_rewrite helper.

0.12.3

Added

• Dashboard SSO (OAuth & OIDC). Native sign-in for Google, GitHub, and any OIDC-compliant provider (Okta, Auth0, Keycloak, Microsoft Entra) sits alongside the existing password login. Multiple named OIDC providers run side-by-side, each rendered as its own button on the login screen. Configuration is env-var driven (TASKITO_DASHBOARD_OAUTH_*); the oauth extra (pip install 'taskito[oauth]') pulls in authlib, joserfc, and requests. Security: PKCE S256, single-use server-side state (5-min TTL), nonce verification, JWKS-validated ID tokens, issuer/audience/expiry checks, open-redirect protection on the post-login next URL, HTTPS-only redirect URIs outside localhost. Allowlists by Google Workspace domain, GitHub org, or OIDC email domain. Promote OAuth users to admin via an explicit TASKITO_DASHBOARD_OAUTH_ADMIN_EMAILS list, with a first-user-wins fallback for empty deployments. Password login can be disabled entirely with TASKITO_DASHBOARD_PASSWORD_AUTH_ENABLED=false.
• Dashboard SSO operator guide. New Dashboard › SSO (OAuth & OIDC) doc walks through registering OAuth clients with Google, GitHub, and generic OIDC providers, plus the full env-var reference, allowlist semantics, security model, and troubleshooting cookbook. Includes a Mermaid sequence diagram of the end-to-end flow.

Changed

• Docs nav: dedicated Dashboard section. The dashboard documentation outgrew Observability — five pages (overview, authentication, SSO, task overrides, REST API) versus three actual observability topics. Moved them into their own top-level Guides section and stripped redundant prefixes from page titles (Dashboard Authentication → Authentication, etc.). All cross-section links updated.

Fixed

• WebhookManager delivery thread leak. reload() unconditionally spawned a daemon thread on every Queue construction. With ~800 tests each creating a fresh Queue, macOS CI runners blew through the per-process thread limit and panicked in r2d2's reaper / tokio's worker-thread spawn (Resource temporarily unavailable). The thread now starts only when at least one subscription exists, matching the pre-0.12.2 behaviour.
• EncryptedSerializer.loads exception handling. A blanket except Exception re-wrapped every failure as ValueError, including programmer errors like MemoryError that should propagate untouched. The catch is now narrowed to cryptography.exceptions.InvalidTag (the one expected failure mode); the original exception is preserved on __cause__ for debugging. The InvalidTag class is also pre-cached on __init__ so loads avoids a per-call import. This also fixed two latent test failures (test_wrong_key_fails, test_tampered_ciphertext_fails) that only surfaced once a release pulled in cryptography via the OAuth extra.

Internal

• HttpClient Protocol for OAuth providers. GoogleProvider / GitHubProvider / GenericOIDCProvider previously typed their http parameter as requests.Session, forcing every test to use # type: ignore[arg-type] to inject a stub. The Protocol captures the small subset of Session actually used (one get method) so production code passes a requests.Session and tests pass an in-memory stub — no nominal-type fight, no runtime casts.
• CI installs the oauth extra. uv sync --extra dev was leaving authlib / joserfc / requests uninstalled, so the OAuth test modules failed collection with ModuleNotFoundError once they shipped. Both lint and test jobs now sync --extra dev --extra oauth. requests is also pinned explicitly in the oauth extra (Authlib does not declare it as a hard dep).
• Cross-version mypy compatibility on JWKS decoding. joserfc.jwk.KeySet.import_key_set was widened to accept dict-shaped JWKS in mypy 2.x; mypy 1.x still requires the KeySetSerialization TypedDict. Suppressed with the standard # type: ignore[arg-type, unused-ignore] dual pattern so the file lints under both versions.

Test counts at release

• Rust: 95 tests (default), 107 with --features workflows
• Python: 896 collected across 74 files (up from 592 / 58 at 0.12.2)
• Dashboard (vitest): 106 tests across 10 files

0.12.2

Fixed

• Inline imports inside the predicate boolean combinators. AndPredicate.evaluate, OrPredicate.evaluate, and NotPredicate.evaluate were each importing _resolve_outcome from taskito.predicates.evaluate inside the method body. The cycle they were defending against doesn't exist at runtime — evaluate.py only references core under TYPE_CHECKING — so the import was hoisted to module scope, satisfying the project's no-inline-imports rule.

Internal

• QueuePredicateMixin extracted from app.py. Predicate state (six instance dicts and PredicateMetrics) plus the three gating methods (_apply_enqueue_predicate, _apply_dispatch_predicate, _reenqueue_after_defer) and the public inspection / registration API (list_predicates, predicate_for, register_predicate) now live on a dedicated mixin under py_src/taskito/mixins/predicates.py. Repeated _emit_event(...) blocks consolidated into small helpers. app.py drops from 901 to 619 LOC.
• QueueRuntimeConfigMixin split from mixins/decorators.py. register_type, set_queue_rate_limit, and set_queue_concurrency are runtime configuration knobs, not decorator surface — they moved to a new mixin alongside the existing QueueSettingsMixin (which manages dashboard key/value state). mixins/decorators.py drops from 597 to 533 LOC.
• Migration DDL deduplicated via diesel_common/migrations.rs. The run_migrations() methods on SqliteStorage and PostgresStorage shared ~750 LOC of nearly-identical CREATE TABLE / CREATE INDEX / ALTER TABLE statements. The shared module now exposes create_tables(&dialect), create_indexes(), and alter_statements(&dialect); a Dialect struct holds per-backend type substitutions (BLOB/BYTEA, INTEGER/BIGINT, REAL/DOUBLE PRECISION, boolean defaults, and the IF NOT EXISTS prefix on ALTER). Each backend's run_migrations() is now a ~10-line driver. sqlite/mod.rs drops 502 → 126 LOC; postgres/mod.rs drops 508 → 130 LOC.
• tests/core/test_predicates.py — 30 focused tests covering AST short-circuit semantics, fail-closed evaluation + metric recording, JSON and string-DSL round-trips, recipe behaviour (after/before/in_time_window/payload_matches/env_var_truthy), the callable adapter, custom predicate registration, and three queue integration tests for enqueue-time cancel/defer.

Test counts at release

• Rust: 95 tests (default), 107 with --features workflows
• Python: 592 passed, 9 skipped across 58 files
• Dashboard (vitest): 121 tests across 9 files

0.12.1

Fixed

• PyPI wheels and sdist now bundle the compiled dashboard. A regression in 0.12.0 shipped wheels with an empty taskito/static/ directory because the release pipeline ran maturin build without first building the dashboard frontend. End users hit Dashboard assets not bundled when running taskito dashboard. The release pipeline now builds the dashboard once in a dedicated job, distributes it to every wheel/sdist job as a build artifact, and verifies static/dashboard/index.html is present before each maturin build invocation — preventing the regression class entirely.

Internal

• .github/actions/dashboard-build/ — composite action centralizing pnpm/Node toolchain versions and the dashboard build steps. Consumed by both publish.yml (release) and dashboard.yml (CI), so the assets shipped in a wheel are produced by the exact same build path that CI tests on every PR.