Migrating to Flow 5.0.0#
Flow 5 removes opaque authority metadata from trust attachment and moves project-config publication behind a trusted host capability. Both changes fail closed where earlier versions accepted ambient metadata or wrote configuration directly.
Breaking: trusted-producer authority is embedded, scoped TrustBundle data#
Before: Flow accepted opaque attachment/config/CLI authority metadata such as authority_trace, authority_traces, and legacy authority options. That metadata was not an authority proof bound to a claim, evidence, actor, subject, and evaluation time.
After: those attachment fields and CLI options are removed. Configure only authority_refs; the matching active authority trace must be embedded in the attached TrustBundle and scoped to the selected claim/evidence.
Migrate:
- Remove
authority_trace,authority_traces, and their CLI equivalents from authored config and attachment calls. - Move the authority proof into the producer's TrustBundle
authorityTrace, with its subject, actor, claim/evidence references, and validity interval. - Replace opaque reference lists with the corresponding
trusted_producers.<claim-type>.authority_refspolicy. An explicit empty producer/reference list is deny-all, not an omitted policy.
Breaking: Flow no longer writes project config itself#
Before: flow config apply could merge and write .flow/config.json directly from the standalone CLI.
After: config application requires a trusted host capability, FlowConfigMergePublisher. The standalone CLI remains discoverable, but reports that apply is unavailable rather than writing config.
Migrate: implement the publisher in the host that owns the project configuration (for example, a desktop host). The publisher receives canonical proposed bytes, the expected base digest, output digest, and paths; it must publish atomically and return a bound receipt. Flow validates that receipt before reporting an applied result. Where no configured publisher is available, use flow config preview <proposal> to inspect the proposed changes without writing project config.
This separation keeps Flow provider-neutral and lets a host enforce its own file access, conflict handling, and user-facing configuration UX.