Release v0.7.0

[bburda]

Summary

Cut release 0.7.0. 0.6.0 shipped 2026-06-22. Since that tag main has 59 merged PRs and every package.xml is still at 0.6.0. This issue tracks the documentation work, the changelogs, the bugs that have to go in first, and the pre-tag checklist.

Highlights since 0.6.0

New packages

• ros2_medkit_fault_detection - shared, protocol-agnostic fault detection for gateway plugins: threshold, status bit and fault-code enum in one header-only evaluator (Shared fault-detection: threshold + status-bit + fault-code enum #486). Also added to the Docker image workspace (Add ros2_medkit_fault_detection to the Docker image workspace #494).
• ros2_medkit_graph_watchdog - gateway plugin that raises a fault for graph problems nothing reports today. Three detectors so far: QoS mismatch (feat(graph_watchdog): plugin scaffolding + QoS-mismatch detection #571), orphan (feat(graph_watchdog): orphan detector (GRAPH_ORPHAN) #578) and parameter drift (feat(graph_watchdog): param_drift detector (GRAPH_PARAM_DRIFT) #580).

OPC UA and PLC

• Config-less discovery. A read-only network scan finds the server (feat(opcua): read-only PLC network discovery -> auto_browse #509), auto_browse walks the address space and builds the SOVD tree from it (feat(opcua): recursive auto_browse -> SOVD tree from OPC UA address space #510), native Alarms and Conditions become faults with no configuration (feat(opcua): zero-config native A&C alarms -> faults #511), and identity, writability and fault triggers are read from the device itself (Config-less discovery: device-derived identity, A&C faults, AccessLevel writable, runtime fault triggers #544).
• Identity from the device: nameplate fields (Populate asset identity from OPC UA device information #492) and order_code (feat(opcua): populate order_code identity field from the device nameplate #499).
• PLC_COMMS_LOST fault when the connection drops (feat(opcua): raise PLC_COMMS_LOST fault on connection loss #507), alarms routed to separate faults by message substring (feat(opcua): route alarms to distinct faults by message substring #506), severity accepted as an alias in event_alarms (fix(opcua): accept severity as an alias in event_alarms #501), non-condition events dropped from the alarm path (fix(opcua): drop non-condition events from the alarm path #552).
• Security and reconnect hardening, replay after reconnect, multi-alarm handling, secure profile (OPC UA + gateway hardening (security, reconnect replay, multi-alarm, secure profile) #485). Fixed a data race between the REST and poll threads that crashed the gateway (fix(opcua): thread-safety fix for the REST/poll fault-buffer race #519).

Faults

• Append-only, hash-chained audit log of fault state transitions, off by default (Tamper-evident append-only fault audit log #487).
• Freeze-frame: a compact JSON snapshot is persisted when a fault is confirmed (Persist compact JSON freeze-frame on fault confirm #491), the faulting entity's own data is captured with no configuration (feat: zero-config freeze-frame - capture the faulting entity's own data by default #538), faults already raised at startup get one (fix(gateway): freeze-frame the faults that were already raised at startup #563), and so does an entity serving last known values (fix(gateway): freeze-frame an entity that is serving last known values #565).
• Black box: a fault confirmed inside an active post-roll window keeps its bag (fix(fault_manager): keep a black box for faults confirmed mid post-roll #561), and a fault landing on a recording-window boundary now gets its own bag (fix(fault_manager): give the fault at a recording-window boundary its own bag #594).
• Debounce counter clamped, confirmed and healed status latched (fix(fault_manager): clamp debounce counter and latch confirmed/healed status #484). A PASSED event no longer re-dates a fault, and real SSE loss is counted (Stop PASSED events re-dating a fault, and count real SSE loss #573).
• Faults from plugin-provided entities are visible in list, detail and freeze-frame through fault-scope ownership (fix(gateway): surface external plugin-entity faults (list, detail, freeze-frame) via fault-scope ownership #503), and an external Component owns its fault manager faults (Fault scope: external Component owns its fault_manager faults (#516) #530).
• FaultReporter can be built from an rclcpp_lifecycle::LifecycleNode (Lifecycle Construction for Fault Reporter #556).

Assets and manifest

• Asset identity model with per-field provenance and merge-by-identity (Asset-identity model + merge-by-identity #488).
• Manual asset inventory from a manifest assets: list or a CSV file (Manifest/CSV manual asset inventory #493).

Gateway

• x-medkit-graph health model reworked. pipeline_status no longer reports "broken" for an edge with no /diagnostics coverage, metrics.source is the resolved publisher, per-function overrides now take effect, schema_version is "2.0.0" (feat(graph_provider): rework x-medkit-graph health model (#545) #546).
• Nested plugins.<name>.* parameters are rebuilt into a nested object instead of a flat key, so nested plugin config works again (fix(gateway): reconstruct nested plugin config from dotted ROS params #518).
• An unresponsive parameter node no longer hangs the REST API (Stop an unresponsive parameter node from hanging the REST API (#531) #532), per-node parameter caches are bounded with LRU eviction (fix(gateway): bound parameter transport per-node caches with LRU eviction #534), the transport's node is released before the context dies (fix(gateway): release the parameter transport's node before the context dies #567), and the error surface is consistent between list and get (fix(gateway): non-404 parameter errors win over NOT_FOUND across nodes #540, fix(gateway): consistent parameter-config error surface (list vs get) and drop dead classify fallback #543).
• server.executor_threads is now real, and a cancel timeout is reported as a timeout (fix(gateway): make executor_threads real and report a cancel timeout as a timeout #593).
• Data triggers work on plugin entities and fail loudly on a bad topic name (Data triggers on plugin entities: resolve from declared topics, fail loud on bad names #592). Trigger subscriptions go through the shared subscription executor (fix(gateway): route trigger subscriptions through the shared subscription executor #549).
• Plugin-provided entities own their bulk data and logs (fix(gateway): plugin-provided entities own their bulk data and logs #560), and the external flag survives the hybrid merge (fix(gateway): preserve plugin App external flag through hybrid merge #522).

Build, CI and tests

• Every C++ package is instrumented for coverage (build: instrument every C++ package for coverage #582). Clang-tidy analyses a package's translation units in parallel (perf(cmake): analyse a package's translation units in parallel under clang-tidy #588), and PR feedback time went from about 56 to about 35 minutes (Cut PR feedback time from 56 to about 35 minutes #590).
• Every integration launch test runs on its own DDS domain, taken at run time (test: isolate every integration launch test on its own DDS domain #551, fix(test): give each test its own DDS domain, taken at run time #597). Inline gateways and fault managers go through the shared helpers (test: route inline gateways and fault managers through the shared helpers (coverage SIGKILL fix) #554). Python in the integration test package is linted (test(integration): lint the Python in ros2_medkit_integration_tests #598).
• arm64 multi-arch image, gated on tag or dispatch (ci: arm64 multi-arch image (tag/dispatch gated) #508). Fault bridges bundled in the image (Bundle the fault bridges in the image; docker-first quick start #470).

Behaviour changes to call out

• x-medkit-graph schema_version is "2.0.0". error_reason values node_offline, topic_stale and no_data_source are gone; the only reachable value is metrics_stale. A consumer that matched on the old values needs a change (feat(graph_provider): rework x-medkit-graph health model (#545) #546).
• The lifecycle status operationIds were pluralized, so generated clients get renamed methods for those operations (Fix pluralized lifecycle status operationIds (closes #475) #497).

Bugs to fix before the tag

• [BUG] All 70 launch tests fail in the Humble binary package build #602 - all 70 launch tests fail in the Humble binary package build. The deb is published anyway because bloom runs the tests as dh_auto_test || true. This repeats on every Humble release until it is fixed.
• [BUG] Manifest top-level config: block is silently ignored (config read only from discovery:) #529 - a manifest with a top-level config: block is read by nobody. ManifestParser::parse_config is only called with root["discovery"], so the setting is dropped without a word and unmanifested nodes leak into the tree in hybrid mode.
• [BUG] clamp_thread_count silently changes a mis-set thread count #603 - clamp_thread_count and clamp_keep_alive_timeout change a mis-set value and log nothing. The config file and the running process disagree and there is no way to see it.
• [BUG] cgroup_reader misses cgroup v1 and non-root cgroupns=private paths #604 - cgroup_reader handles only one of the three common cgroup layouts. Pure cgroup v1 returns nothing, and cgroupns=private, which is the Docker default, builds a path that does not exist.
• [BUG] Aggregator times out fanning out large resource payloads to peers #528 - a large resource fanned out to a peer times out in the aggregator. aggregation.timeout_ms defaults to 2000 ms and is used for both connect and read, so a big body cannot make it in time.

Filed after this issue was written:

• [BUG] GET /faults/stream on an aggregating gateway returns 200 and streams nothing #611 - GET /faults/stream on an aggregating gateway returns 200 and streams nothing.
• [BUG] A timeout is never reported as a timeout #612 - a timeout on an operation routed to a peer is not reported as a timeout.
• [BUG] The aggregator refuses or 404s entity work its peers can serve #613 - the aggregator refuses or 404s entity work its peers can serve.
• [BUG] A missing message package is reported as a gateway fault, or as no data at all #614 - a missing message package is reported as a gateway fault, or as no data at all.
• [BUG] An SSE fault-stream slot is held for up to 30 s after the client disconnects #615 - an SSE fault-stream slot is held for up to 30 s after the client disconnects.

#528, #611, #612 and #613 are one subsystem and share aggregation.timeout_ms and the peer fan-out, so they are being fixed together rather than one at a time. #614 and #615 still need a decision on whether they block the tag.

Already fixed, close after checking:

• gateway: nested plugins.<name>.* params silently dropped (flat JSON key) #520 - fixed by fix(gateway): reconstruct nested plugin config from dotted ROS params #518.
• opcua: data race on pending_reports_ crashes gateway (SIGSEGV) #521 - fixed by fix(opcua): thread-safety fix for the REST/poll fault-buffer race #519.
• [BUG] OperationHandlersFixtureTest.ListExecutionsReturnsTrackedActionGoal flaky under sanitizers #473 - the test was rewritten in ci: harden flaky suite checks (opcua A&C, action-status, diagnostic_bridge, operation_handlers, type_info, docs linkcheck) #504. Confirm the sanitizer jobs are green and close.

Documentation

ros2_medkit_graph_watchdog is not wired into the docs at all. It has a README and a design document in the package, and neither reaches the Sphinx build.

• Add src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/CHANGELOG.rst. The package has none.
• Add the include for it in docs/changelog.rst.
• Add the docs/design/ros2_medkit_graph_watchdog symlink to the package design/ directory.
• Add it to the toctree in docs/design/index.rst.
• Add docs/config/graph-watchdog.rst and list it in docs/config/index.rst. The 685-line package README is the only description of the detector configuration today.

Other gaps:

• docs/config/fault-manager.rst does not mention the audit log. The five parameters from Tamper-evident append-only fault audit log #487 (audit_log.enabled, audit_log.transitions, audit_log.retention_max_records, audit_log.fail_closed, audit_log.database_path) are only in the package README.
• src/ros2_medkit_fault_detection/CHANGELOG.rst dates its initial release as 0.6.0 (2026-06-22). The package landed after that tag and was never in it. Move the entry to 0.7.0.
• Check the root README against what the release actually ships, in particular graph watchdog and the config-less OPC UA path.
• Run python scripts/generate_verification.py and check the documentation build has no warnings. The build uses -W.

Changelogs

Target section: 0.7.0 (<date>).

Four packages have a Forthcoming section, and it covers only part of what changed:

• ros2_medkit_gateway - one entry, 141 changed files.
• ros2_medkit_fault_manager - one entry, 29 changed files.
• ros2_medkit_fault_reporter - two entries.
• ros2_medkit_graph_provider - two entries.

Changed with no entry at all:

• ros2_medkit_opcua - 36 changed files, the largest gap after the gateway.
• ros2_medkit_graph_watchdog - 49 changed files, no CHANGELOG file yet.
• ros2_medkit_integration_tests - 60 changed files.
• ros2_medkit_cmake - 23 changed files.
• ros2_medkit_serialization - 9 changed files.
• ros2_medkit_action_status_bridge, ros2_medkit_diagnostic_bridge - 7 changed files each.
• ros2_medkit_fault_detection - 5 changed files.
• ros2_medkit_log_bridge - 4 changed files.

Two entries that must not be missed, both about the rosbag storage default:

• The default bag format goes back to mcap in Declare the rosbag storage plugins, default to mcap, and serialize the plugin loader #610. This is operator-visible and breaking: bags land as .mcap instead of .db3 and the bulk-data download filename changes with it. The release notes are the only migration surface, so ros2_medkit_fault_manager needs an entry under 0.7.0. The last time this default moved (e526ce48, shipped in 0.6.0 as a crash-safety fix) the flip itself was never written down, which is how it went unnoticed for a release.
• Correct the 0.4.0 entries. src/ros2_medkit_fault_manager/CHANGELOG.rst and src/ros2_medkit_gateway/CHANGELOG.rst both say under 0.4.0 "Default rosbag storage format changed from sqlite3 to mcap". That was reverted by e526ce48 and the code has shipped sqlite3 ever since, so the released changelog has claimed mcap for two releases while the default was sqlite3. Decide whether to correct the 0.4.0 lines in place or to note the reversal under 0.7.0.
• ros2_medkit_msgs - 3 changed files.
• ros2_medkit_sovd_service_interface, ros2_medkit_beacon_common, ros2_medkit_linux_introspection, ros2_medkit_param_beacon, ros2_medkit_topic_beacon - one changed file each, a version bump note is enough.

Version bump

• scripts/release.sh bump 0.7.0. It updates 19 package.xml, core/version.hpp, docs/conf.py, docs/pyproject.toml, docs/Doxyfile, QUALITY_DECLARATION.md and the examples in docs/api/rest.rst.
• scripts/release.sh verify 0.7.0 reports all OK.

Pre-tag

• Decide what happens to the two packages that are not in rosdistro yet. 16 packages are released at 0.6.0-1; the tree has 19. ros2_medkit_fault_detection is only depended on by ros2_medkit_opcua, which stays out. ros2_medkit_graph_watchdog is a leaf and its test dependencies are all released. Either add both to the packages list in a rosdistro PR, or leave them out on purpose.
• Full CI passes on Jazzy, Humble and Lyrical on release/0.7.0.
• Tag 0.7.0 and bloom-release the supported distros (jazzy, humble, lyrical; ros2_medkit_opcua excluded).