Orch8 0.7.0 — Release Guide

Orch8 0.7.0#

Released July 28, 2026. Version 0.7.0 expands Orch8 from durable workflow execution into an evidence-driven continuity and release platform while keeping the existing sequence JSON and durable parent/child lifecycle.

GitHub release and checksums Changelog

Install 0.7.0#

Pin production deployments to 0.7.0. The floating latest image is convenient for local evaluation but makes rollback and provenance harder.

Bash

# macOS or Linux binary (installer resolves the current release)
curl -fsSL https://raw.githubusercontent.com/orch8-io/engine/main/install.sh | sh
orch8-server --version

# Reproducible container deployment
docker pull ghcr.io/orch8-io/engine:0.7.0
docker run --rm ghcr.io/orch8-io/engine:0.7.0 --version

# Image index digest for amd64 + arm64
# sha256:80d23764e0dbbd3330ce853e068bf8b6215b6845e167dafcb140c636551aac39

Note

Git tags include the conventional v prefix (v0.7.0); binary, crate, package, and container versions use 0.7.0.

What shipped#

The groups below summarize every user-facing capability family in the release. Exact request and response schemas remain authoritative in the running server at /api-docs/openapi.json and/swagger-ui. Depending on authentication mode, request these routes with the deployment's API-key and tenant headers; 0.7.0 still requires a tenant header in insecure-auth mode.

Durable execution and effects

✓A universal effect ledger records side-effecting built-ins, plugins, WASM, gRPC, ActivePieces, and external-worker dispatches.
✓Commit-guarded effect_at_most_once invariants can reject duplicate dispatch before a provider sees it.
✓Receipt-derived compensation plans reverse only committed or verified effects and retain unresolved residuals for operators.
✓Provider failover refuses unsafe replay when a non-idempotent operation may already have reached the prior provider.
✓Conditional retries, step guards, output schemas, Saga blocks, webhook replay protection, and crash-safe capsule redelivery are now part of the execution model.

Continuity, edge, and mobile

✓Portable Continuity adds signed capsules, epoch-based ownership, global location history, live migration and rollback, and resumable output transfer.
✓Placement uses live runtime capabilities, locality policy, trust, residency, connectivity, battery, cost, latency, and drain state.
✓Mobile devices can advertise bounded runtimes; federation adds destination-bound signed envelopes with replay-safe verification.
✓Time travel, effect-free what-if analysis, fault-lab exploration, production-test extraction, and cryptographic provenance make recovery evidence inspectable.
✓Tumbling, sliding, and session windows expose bounded event/stream views without a second stream database.

Workers, agents, and dataflow

✓External workers can checkpoint long activities through lease-safe heartbeat compare-and-swap updates.
✓Tenant-scoped shared agent memory is encrypted, namespaced, bounded, and isolated from other tenants.
✓Typed dataflow compiles input/output schemas and direct references into deterministic TypeScript, Python, Swift, and Kotlin bindings.
✓Human-attention tasks use leased assignment, payload-free decision digests, and cumulative budget settlement.
✓The optimization advisor and stored-evidence evaluation gates create auditable draft releases without mutating production.

Operations and release safety

✓Bounded Parallel branches now overlap while ForEach remains the bounded map/reduce primitive.
✓Cooperative priority preemption yields lower-priority flat workflows only at durable step boundaries.
✓The release control plane supports semantic diff, effect-free validation, deterministic canaries, evidence gates, promotion, pause, and rollback.
✓Preflight, contracts, scenario tests, template inspection, stuck-instance diagnosis, webhook inspection, and DLQ reproduction turn failure evidence into runnable remediation.
✓PostgreSQL migration 074 hash-partitions block_outputs and audit_log into 16 partitions each for their dominant lookup keys.

New 0.7.0 syntax#

Use the versioned API#

Bash

export ORCH8_URL=http://127.0.0.1:8080/api/v1
export ORCH8_API_KEY='replace-me'
export ORCH8_TENANT_ID=demo

curl -sS "$ORCH8_URL/instances/$INSTANCE_ID/effects?tenant_id=$ORCH8_TENANT_ID"   -H "x-api-key: $ORCH8_API_KEY"   -H "x-tenant-id: $ORCH8_TENANT_ID"

Bare product routes remain compatibility aliases, but new integrations should use /api/v1.

Checkpoint a long worker activity#

JSON

POST /api/v1/workers/tasks/{id}/heartbeat
{
  "worker_id": "video-worker-3",
  "checkpoint_seq": 0,
  "checkpoint": {
    "completed_batches": 12,
    "cursor": "next-page-token"
  }
}

The response returns the next checkpoint_seq. A stale sequence or former lease owner receives 409 and cannot overwrite newer progress. Checkpoints are limited to 256 KiB.

Declare effect compensation#

JSON

{
  "type": "step",
  "id": "charge",
  "handler": "payments.charge",
  "params": { "amount": 4200 },
  "compensation": {
    "handler": "payments.refund",
    "params": { "amount": 4200 },
    "depends_on": ["reserve_inventory"],
    "verification": "provider_receipt"
  }
}

Compile typed dataflow in CI#

Bash

orch8 sequence dataflow --file checkout.json --out-dir generated
# Writes types.ts, types.py, Types.swift, Types.kt, schema.json, report.json
# and exits non-zero when the report contains an error.

Run a guarded canary#

Bash

RELEASE_ID=$(orch8 --output json release create   --tenant-id demo   --baseline "$BASELINE_ID"   --candidate "$CANDIDATE_ID"   --max-error-regression 0.05   --min-sample 20 | jq -r '.id')

orch8 release diff "$RELEASE_ID"
orch8 release validate "$RELEASE_ID" --sample 20
orch8 release canary "$RELEASE_ID" --percent 10
orch8 release evaluate "$RELEASE_ID"
orch8 release promote "$RELEASE_ID"

Migration checklist#

Upgrade clients to the canonical /api/v1 base and send x-api-key plusx-tenant-id on authenticated requests.
Treat the fast path as at least onceafter a crash during a step. Completed outputs are memoized, but a provider may have observed an effect before its receipt committed. Use provider idempotency keys, the effect ledger, and commit guards for operations that must reject duplicates.
Update handoff creation to include theplacement_decision_id andpreview_sha256 returned by the placement preview. The engine rechecks live facts and rejects stale decisions.
Configure a secret on every public webhook trigger and verifyX-Orch8-Timestamp plusX-Orch8-Signature. Unsigned public webhooks are rejected in 0.7.0.
Reserve a PostgreSQL migration window for migration 074. Converting existing block_outputs andaudit_log tables requires a table rewrite.
If building from source, use Rust 1.97 or newer. Run preflight, contract tests, and a release validation before increasing canary traffic.

Warning

“Exactly once” is not a universal provider guarantee. Orch8 can enforce an at-most-once dispatch guard for a declared effect identity, but an external provider outcome can still be unknown after a timeout or crash. Reconcile unknown receipts instead of replaying them blindly.

Ready to try Orch8?

One command to install. Then run your first local sequence.

Bash

curl -fsSL https://orch8.io/start.sh | sh

Quick Start Guide Or skip the setup with Cloud →

Previous← Overview NextQuick Start →