v0.1.0-alpha.493¶

Released 2026-10-20.

Features¶

A configuration may declare the code its code sources run: code/
.tar.gz (or.tgz or.zip) beside its config.yaml, a source naming it as uploaded code by the content hash of the code it unpacks to (code: {kind: upload, upload:
}).
- A demo's declared code archives are kept as its org's uploads
- The bundle build's answering config is served beside the demo's declared rows and code

Request deadlines are watched by one shared watchdog thread per process instead of a threading.Timer per request; a request that passes its deadline is cancelled as before, on every transport that registers a cancel.

A relationship may feed its target table's parameters from its source table: its parameters map names each fed parameter and the source column whose value it is given (several parameters, each from its own column).
- A relationship feeds a code table's parameters from its source rows

A Node or Python code source declares the names its code may read (secrets in its mapping): a list of names, each the org secret of that name, or a mapping of name to vault reference (${secret:NAME} or ${env:NAME}).
- A code source's declared secrets, read at use through Provisa's services
- The egress proxy answers Provisa's services through a CONNECT tunnel
- A declared secret picked by name stays a name; the product spells no reference
Provisa's services to a code source's worker include an OpenAI-compatible LLM service at $PROVISA_SERVICES/llm/v1: POST chat/completions and embeddings, so any SDK works with its base URL there and no key, the worker's scoped token being in the address; the egress proxy answers it for a local worker.
- An OpenAI-compatible LLM service for a code source's worker

The named demo churnprod puts the churn demo's model in production.
- The churn model as a Python package and its Node twin
- churnprod, the churn model in production
- churnprod's store names its data per version; check_demo requires it
The named demo cloudpolicy reviews a cloud security policy after the fact, read only.
- The cloud policy's reader and the cloudpolicy demo's data generator
- cloudpolicy, a cloud security policy reviewed across three clouds
- cloudpolicy's card, Superset dashboard picture, published
A named demo, World Cup: public sources about the World Cup whose country names disagree become one governed graph.
- World Cup, public sources made to agree and queried as one graph

Each step reports paging beside its CPU per request
A masked column is one that is not the primary key; the fake admin answers only what the schema takes
An MCP transport, run_sql over Streamable HTTP, in the perf contract
The Postgres-only pass leaves out relationships naming a gone table by alias or via table
The three-device harness runs a governance pass, its devices sized by one flag

cloud.provisa.dev's sandboxes run Polly on OpenRouter's Claude Haiku; a tier node without OPENROUTER_API_KEY is refused by name

Shared Qdrant and Kafka, finished: tests to the shared design, no compose default

The image trusts Microsoft's 2025 signing key, which signs its Debian 13 repository

The core tour registers a source and a table; Skip works while a step waits
Query it everywhere covers nine surfaces: Python and the Notebook
pollyOpen is an explicit flag on the steps that show Polly's panel; "Just ask" stays shut

The graph renderer type-checks without the app's client: ResultRedirect is its own type
No domain picker offers meta or ops as the domain to put something into
A source staged from a Kaggle dataset shows as Kaggle in the Sources list