# OpenRath v1.3.0

Released July 8, 2026.

## What changed

v1.3.0 adds a static inspection layer for workflows and strengthens the
runtime's persistence, configuration, provider-placement, and OpenSandbox
foundations. These capabilities are additive; workflow compilation remains
opt-in.

| Area | Addition |
| --- | --- |
| Workflow compile | `Workflow.compile()`, `CompiledWorkflow`, `ResourceManifest`, offline `validate()`, and deterministic memory lifecycle. |
| Module tree | Nested `Workflow` attributes register as children and are exposed through `named_children()` / `modules()`. |
| Provider placement | `AgentParam.to(...)`, `Workflow.to(...)`, and type-dispatched `Session.to(...)`. |
| Config safety | API keys move from `config.json` to `credentials.json` (mode `0600` on POSIX) on save. |
| Environment registry | Central `EnvSpec` declarations and generated environment reference data. |
| Persistence | Shared atomic JSON/text helpers, root layout manifest, and dry-run-first cross-plane GC. |
| OpenSandbox | Current v1.1.0 code-interpreter image, longer creation budgets, and targeted transient retries. |

## Compatibility boundaries

- `Workflow.to(...)` only rebinds direct `AgentParam` values. Iterate
  `workflow.modules()` to cover a nested tree.
- `CompiledWorkflow.manifest` is a snapshot; recompile after provider or
  structure changes.
- Session-bound providers survive `fork()` and `detach()` and are left-biased
  by `merge()`, but are not serialized and are not copied to loop/compress
  outputs.
- Inline `api_key` values still load and migrate on the next save. Keys set to
  `None` are omitted when a non-empty credentials payload is rewritten, but an
  existing sidecar remains untouched when the new payload is empty.
- GC defaults to `dry_run=True`. Removing a remote sandbox record does not
  terminate the remote container.

Full code changes:
[v1.2.2...v1.3.0](https://github.com/Rath-Team/OpenRath/compare/v1.2.2...v1.3.0).