v0.1.0-alpha.495¶

Released 2026-10-22.

Features¶

Column-Level Lineage Graph¶

Lineage reaches below the registered table to the source itself.
- Native hop beneath each source column, element links
- A remote GraphQL table's native hop names its required arguments
- A remote GraphQL table's native hop names its required arguments

Data Catalog Integration¶

Data products are part of the built-in meta domain.
- Data products in the meta domain, reached by relationships
- A checker table reaches the table its contract scans
The meta domain has a view-only data_product_edges view, related to data_products_meta by product_id.
- data_product_edges and the build-written lineage edge table
- data_product_edges names every table as the model does
The meta domain has a view-only column_lineage_edges view with one row per column-level lineage edge: the source relation and column, the target relation and column, and the view that derives the target.
- column_lineage_edges in the meta domain
- The page and its panel's core are read from the meta domain as the user
- The graph and panel as rendered: readable domains and edges, a smaller halo, the full graph's foot in view, columns named with their table, column lineage once a table is expanded, the panel's queries a selection a line
- A column lineage edge's ends are source and target, not its column names

Derived / MV Processor¶

A materialized view's build takes the same route decision a query with its definition takes: a definition one source reads whole runs at that source, on any engine kind, and only its result rows come back; they are staged beside the view's table and every build step reads them there.
- A view's build takes the query route decision; a single-source build runs at its source and stages only its rows
A calendar can declare the local time its day closes at, in its time zone (an 18:00 close of business in Europe/London); a day then runs from the previous day's close to its own, every grain's boundary moves with it, and a daily view refreshes at the close.
- A calendar's day can close at a declared local time instead of midnight
A config declares its calendars in a calendars: section (name and version required, then base_system, tz, fiscal_anchor_month, fiscal_anchor_day, retail_anchor, week_start, holidays, weekend and day_close), stored before the tables whose views name one and refused for exactly what the createCalendar mutation refuses; the model export writes them back.
- A calendar is declared in config; refreshMv builds a view sealed at a business day's close
- banking's setup commits each day before it is sealed; a seal that records nothing is refused

Materialization Store¶

A table or a view is bitemporal by mapping three values to its columns: business_key (what identifies the same thing across versions), valid_time (the date the business gives the record: when it was agreed, booked or took effect) and recorded_time (when this version was entered or changed).
- A table or view declares business_key, valid_time and recorded_time in place of the view-level bitemporal mode, key and source time
- A table whose rows are its versions is read as of valid time and as recorded, on every surface
- A versioned table's read picks versions by its key and times whatever the role sees, answering only its columns; the compiled stage is tested
- A view over a versioned table inherits its history; each refresh recomputes only the valid dates recorded since, reads travel on valid time
- Every table and view setting at creation, the Time Travel section in create and edit, the HISTORY badge, the history note and the bitemporal how-to
- A table is registered or updated with every setting in one transaction; a refusal leaves nothing applied
- One save is one transaction; view checks before commit; naming from the server
- The register form's registration is not a busy flag; the mask-list exemption follows the split
- A table updated in place keeps its versions in a captured log
- The build loads what a table maps; a version log's interval and lateness are set on its row
- The version log's settings follow the form rules; banking's init script is executable
- reproduce's "as filed" is cut at the report's first build; debug lines for the as-recorded audit
- A live Kafka table may keep the time Provisa lands each message
A pgwire session sets its time travel with SET provisa.as_of and SET provisa.as_recorded (RESET either, or set it TO DEFAULT); every statement the session then runs, COPY included, reads as a request carrying the matching X-Provisa-As-Of / X-Provisa-As-Recorded headers does.
- SET provisa.as_of / provisa.as_recorded is the session's time travel for every statement it runs

Source Registration¶

A CSV or Parquet source can be given its file by download, a third way beside a path and an upload.
- A CSV or Parquet source given its file by download, its table set up as a draft
- The draft table is the Register Table form's default, its snake_case aliases too
- The download choice reads as a field, its long words behind (?), and only a download source reads its TTL
- A template another Provisa release built is replaced, not loaded
- set-up-as-draft no longer reaches through the resolver's None self

Changes¶

3d¶

The 3D views draw their colours true, on a stage set apart from the page

auth¶

The right to a named environment is judged by the roles the org assigns
A role set's meta-role is built in the environment the request names, unsecured and in the default org
The default org's prod is served unbound, so a meta-role there needs no runtime readied

churnprod¶

The tour's join step finds its relationship on any page; no refused step

code¶

@columns batch column transforms for Node and Python sources
A loader declared on any kind but a table is refused by name

code-hosts¶

The remote host writes its certificate's serial in its one DER form

code-sources¶

An uploaded archive keeps its file's name; the read view shows it; demo code pinned so its image can be built
A code source its config declares is pinned when its model is built; its form lists the code's exports
The Linux sandbox launcher runs by its file's path, not as a module
The server directory's long explanation is help behind its (?), not a hint
Pydantic row types read on purpose; field docs become column descriptions

codehost¶

The front end speaks pgwire, its catalog its functions

codesource¶

Pushdown declarations and name tables for code tables
A name that only looks like a pushdown stays a plain parameter
A read of one code table goes DIRECT, its residual applied by DuckDB
One Python front end in every built image, the residual applied on the host
A lockfile may be given beside any code that carries none; npm-shrinkwrap.json counts as the code's own
A function's loader takes a join's keys in batches
Each runtime resolution stages under a name of its own
An engine reads a host's pinned certificate whoever wrote it
An engine reads the organisation's client certificate whoever wrote it
Closing a table's or stream's rows closes its call, not the collector

commands¶

Host code is off unless the operator allows it

config¶

The shipped configs' landed tables have a landing TTL, and every shipped config is checked on its engines
dim_pet and fact_pet_inquiries read pets and inquiries by their names in the model

cypher¶

An unlabeled relationship's property is read from its own properties, not its JSON
An untyped relationship from a labeled node reads only that node type's relationships
A path or an unlabeled relationship never crosses a table's link to its registration

data-products¶

The data product graph's engine: layers, presets, filters and its 3D scene
The product graph reads the meta domain as the user, by the names the server gives
The graph panel reads its product when it comes into view; product links and lineage lanes from data_product_edges
The graph's legend lists what is drawn, colliding labels yield to the higher-ranked one, and the panel's core leaves checkers to the quality layer

demo¶

Banking -- end-of-day reporting without copying the ledger
The profiling drift step shows what each drifting measure relates, the test checks every one involves postal_code
Publish the banking demo; its tour reaches every step
Banking is unpublished, like retail
The demo keeps its own data directory, and its reset takes its environments' model history
A notice's version time is the newest recorded time the dataset holds; debug lines removed

demo-bundles¶

The node always pulls a demo's latest published version; /wanted is gone

demo-stores¶

An ask during a sync is served by that run; shared postgres and mongo healthy only once their real server answers
The shared stores' health checks use the first address, as the sandbox node gives them two networks
A Kafka demo's own services join the shared stores' network before they first start
A superseded version's own Kafka on the shared Kafka's port is taken down before it starts
A version taken down loses its bundle directory and the images no container still uses
Recreate a shared store whose network is gone; say a failed start to the visitor

demo-tours¶

churn's and retail's GraphQL and notebook steps read as the role their words name

demos¶

Each published demo's video names its tagline, checked by check_demo
cloud.provisa.dev serves worldcup, cloudpolicy and churnprod; a published demo must be in a tier's list
Every demo shell script is executable, so a store's init marker is written on Docker Desktop
The profiling demo shows drift between two runs and a table generated from the profile
A demo's profile runs travel in its bundle and its template loads them
A sandbox's tour warm-up sends each step as the role the tour has chosen by then
Starthere ships supplies.parquet for its org's folder; the tour's live source reads it in place
The open page waits for a demo still starting and opens it once it is ready
A demo's stores are taken down sandbox.demo_stores_linger after its last sandbox closes
A demo whose stores lingered out keeps its images
A template's jobs wait while its demo's stores are taken down

deploy-cloud¶

A deploy to the sandbox VM resets the sandbox tier
Drop each sandbox schema in its own transaction
A failed sandbox reset never leaves the tier down
The sandbox reset wakes the coordinator first
The sandbox-reset arm checks the tier's node first, as every arm

deps¶

Pillow 13.0.0 and certifi 2026.10.19 for the CVE audit

embedded-pg¶

PostgreSQL 16.11 via pixeltable-pgserver 0.5.1; pg_duckdb v1.1.1 (DuckDB v1.4.3)
A killed postmaster's semaphore sets are released with its segment
System V semaphore sets are macOS's alone

engine¶

A native terminal's query reissues nothing beside a coordinator of another

entitlements¶

No feature gate without the commercial plugin

environments¶

A failed creation takes the branch it started; a branch with no environment is refused by name

federation¶

The engine attaches a built code host as a Postgres catalog
A code host is attached only for a built source that asks for it
Every instance of a code-host connector reads the identity the schema build wrote
Beside an engine of another user, its secret files are its group's

flight¶

A read refused by name is answered UNAVAILABLE with its message

gcp-saas¶

The wildcard certificate is kept in Secret Manager and renewed there

glossary¶

The Ontology View: the graph engine scoped to the whole glossary

governance¶

A table read through a physical alias is registered under its schema.table
A table read through a physical alias is registered under its schema.table

graph¶

A flat layout (tree, lanes) is seen from the front; shapes carry a little light of their own
A tree is centred and spread so its names sit side by side; the frontal camera fits the layout to its field of view
A filter of several values stays one line high; the Ontology View's e2e against the real meta views
A glossary term's domains and references are null when it has none
The Ontology View opens on everything, follows the page's search, draws the columns terms ARE, and lays out tighter or looser

graph-schema¶

Its context and root fields come from one surface, taken once
Root fields for every table the role queries, junctions included

graphql¶

A root limit chooses root rows before a lateral join expands them (#278)
A mutation the role holds no grant for is refused as ungranted, not as one its source cannot take

insider¶

Match the mail with a code resolver, not host code
Pair messages and deals through a declared screening scope
match_deals reads the stored view by its registered name
match_deals joins only along declared relationships

join-guard¶

A union's columns are read once per check, not per column

kafka¶

A landing-time column a store's own pipeline would leave unfilled is refused

meta¶

A term's domains and its groundedness in the meta domain
The glossary meta views follow the readable-term rule

metadata-export¶

Org tier stored with the org; production-path e2e for every target
Every ODPS field of a data product reaches each target
Several targets per org; data products as ODPS and ODCS
OpenMetadata 2.0.5, each member's ODCS contract imported
A view member publishes to Atlas and Atlan with no source container; e2e harness reads as org_admin
Google Dataplex data products replace bigquery_dataplex
Microsoft Purview Unified Catalog data products
Amazon DataZone data products
DataZone revises its assets and products by the ids it recorded
Databricks Unity Catalog data products
Unity Catalog tags a view's column through ALTER TABLE and reads a share's full names

naming¶

Store only the preset a convention names

nl¶

A refused NL question is said by its code in the reader's words, not as its body

node¶

Bun runs a source's code installing nothing

notebook¶

matplotlib's font cache is built silently before handed-over cells that draw
JupyterLab's splash removal no longer throws once the splash is gone
Networkx ships with the in-browser Python

oracle¶

A TIMESTAMP WITH TIME ZONE is fetched as a local time zone value, its instant kept
A TIMESTAMP WITH TIME ZONE is cast to its instant in the database
A statement is parsed for its zoned columns, then run once

orgs¶

A destroyed org's jobs stop before its stores are dropped
A destroyed org's jobs stop after its stores pass the delete's checks, before anything is dropped

packaging¶

The image carries the regions sandbox tier's config

pgwire¶

Trust mode asks for no password, so a checker with none connects
The meta terminal binds the governed statement's parameters
The meta terminal binds the governed statement's parameters

polly¶

Every UI action through the admin API, as the chatting user
admin_request uploads a file as its own bytes, as the app's upload routes take it
read_screen reads the screen the user is looking at
read_screen waits for a route's editor still loading, never reads it as absent
A choice closed without picking is answered as closed, never as an empty message

profile¶

The profile runs modal's tables sort and group, results expand, tabs down the side; View Profile Runs in the read-only panel
The profile runs modal's tables filter by column and download as xlsx

profiler¶

A measure that differs only in floating-point rounding is not drifting

replicas¶

A pass whose runtime was dropped under it is left to the next runtime

sandboxes¶

A release change reaps the open visitors' sandboxes at the tier's start
The demos' embedding models load at boot on a bundled tier
An open whose visitor left is closing; the front door outlasts the UI proxy
An open names each stage as it starts and times it as it ends; a store lock wait names the store

secrets¶

No product-written ${env:}/${secret:} reference without a documented convention

sonnets¶

A join feeds lines_like its query; link_echoes is a statement

sources¶

No pgwire write server for a source its config fakes with declared rows
The Code group is Code Resolvers, "Business logic in Python or Node"; every source group is translated

sql¶

A refused statement is said by its code in the reader's words, not as its body

synthetic¶

A synthetic environment generates no profiler's or checker's results

telemetry¶

Compaction finds a signal table whose bucket holds no metadata file
The hourly reclaim leaves a table whose bucket holds no metadata file

tour¶

Core tour steps act, then explain; a step builds a source live
A sql step is ready on its statement's refusal and shows it
A step's anchor rendered again is lit again where it now is
Each demo's steps say only what serves the feature it shows
The 12 locales say each demo's steps as the English now does
The agriculture notebook step points at its figure, scrolled into view, and its words carry no results
The profiling demo shows its run as terrain and postal_code's drift as strata
A step whose Next picks a role is not the end because the role it leaves may open nothing after it

types¶

A character type's character set names its base type (Exasol's VARCHAR(64) UTF8)

ui¶

The splash halo follows the P's loop every frame, so the status note's reflow can't leave it off centre
A code source's Remote host panel is on the Connection tab alone
The tour steps import their prerequisites with a JSON import attribute
A list's row actions are pinned at the row's end; the Materialized Store list's are never cut
The Materialized Store list fits its pane at 1280 with no sideways scroll
Backport monaco-editor 0.57.0's catch on the word highlighter's Delayer.trigger calls
A product's checkers are read through the tables they scan
An empty one-to-many in a meta read is null; the 3D stage gets WebGL in CI and says when it has none
The Environments admin page and nav item are named DataOps
Dialogs that never scroll; one vertical menu; panels and stages fill; terrain column choice; ontology labels are titles
Every page's search bar reads one way: any word matches, a "quoted phrase" is one item
A Grid checkbox on every 3D network graph shows or hides its floor grid

ui-core¶

A checker source loads without its password set; an input-object action argument converts; the files spec waits for its server
A checker names no password under trust mode; an import naming an unset variable is refused by name

views¶

A view applying a column transform keeps its reference through governance