A2UI Python core 0.5 enforces renderer caller boundaries and stricter composition
A2UI Python core 0.5.0 blocks renderer or binding calls to agent-only functions, rejects more catalog-invalid component trees, standardizes the v1.0 wire value and removes remote schema reference fetching. The release includes several breaking compatibility changes.
Why it matters: Agent-generated interfaces cross a security boundary when renderers can invoke functions. Enforcing caller metadata and avoiding network resolution during schema validation reduce two paths for unintended execution or data retrieval.