NEW

Start with the pressure: sales, launch, abuse, agents, data, or guardrails

Versioning and upgrades

Pin, verify, and expect capability-level change

SecEng's overall server tracks a workspace version (0.6.x at last check) via CHANGELOG.md, but the more useful compatibility signal for integrators is the lifecycle tag on the specific capability you depend on.

3 min readServer version (last checked): 0.6.0Changelog convention: Keep a Changelog

Capability lifecycle stages

Every capability in the registry declares one of four stages — check this before depending on one in production.

Reading

3m

  • Experimental — expect breaking change without notice
  • Preview — stabilizing, still pre-1.0
  • Stable — safe to pin against
  • Deprecated — plan migration

What versions independently

The savvy-cli workspace tracks its own release history in CHANGELOG.md, following Keep a Changelog conventions, alongside a Cargo workspace version (0.6.0 at last sync). Independently of that release cadence:

  • Each JSON Schema in seceng-scan-content/schemas/ carries its own $id and dialect (see the schema reference).
  • The capability registry uses seceng.capability.registry.v1 as its own schema version, separate from the server release.
  • The generated OpenAPI document (packages/savvy-sdk/openapi.json) is regenerated per build via cargo run -p savvy-server -- --export-openapi.

Capability lifecycle, the real compatibility signal

Every capability in engines/seceng-engine/src/capabilities.rs declares a lifecycle stage. This is the signal to actually build integration decisions around, not a single product-wide version number:

StageWhat it means for you
ExperimentalContract may change without a deprecation notice. Do not pin production automation to it.
PreviewStabilizing; breaking changes are possible but less likely and should come with notes.
StableSafe to depend on for production integrations.
DeprecatedPlan a migration; a replacement capability should be named.

See the current per-capability lifecycle values in the generated capabilities reference.

Partner policy

  • Pin the specific engine/server build you validated against.
  • Check the capability lifecycle for anything you depend on before every upgrade.
  • Verify checksums on any release artifact you consume.
  • Re-run your golden fixture and error/timeout handling after every upgrade, not only after major ones.
  • Preserve a rollback path to your last-validated build.

Compatibility

Partners should ignore unknown optional fields in structured outputs and validate the declared schema version rather than assuming a fixed shape. SecEng's contracts (including the partner-adapter contracts in commercial/partner-adapters/contracts/) are explicitly pre-1.0: "breaking changes require a schema-version change; compatible additions should prefer optional fields or extensions."

Check before you pin

See current lifecycle per capability

Nine of the current capabilities are Experimental or Preview — none are yet Stable.