[yeongseon]

Summary

Exercise the SDK floor and latest stable resolution using the candidate wheel, including real local Functions host context and redaction assertions.

Changes

• Expand existing wheel and host jobs to SDK 1.21.0 and the latest stable >=1.21.0; retain both host Python cells and all existing gates.
• Install the shared candidate wheel in host cells instead of an editable checkout.
• Add a host endpoint that checks invocation fields, structured JSON and secure redaction using a synthetic canary.
• Document intentionally open SDK bounds, independent Python support, forward-compatibility evidence and the rule that future majors are not certified before passing.

Validation

• The workflow regression failed before adding the SDK matrix (missing strategy).
• Python 3.11.15 make check-all and make build passed: 956 passed, 4 skipped, 4 deselected, 13 warnings in 11.01s; coverage 96.40%.
• Exact head 51825664983f136736472fed7478f6e80269f6f1 passed all required checks in run 40339985318, including both wheel SDK cells and all four real local-host SDK/Python cells. Logs identify SDK 1.21.0 and latest stable 1.25.0; the host contract endpoint asserted structured invocation fields and masking.
• No real Azure deployment was attempted. Local LSP rejects private-worktree paths; repository mypy passed.

Related Issues

Closes #613

The intentionally open SDK bound is protected by the required latest-stable wheel/host lane. No future major is represented as already certified; Python 3.13/3.14 host certification and live Azure ingestion are not claimed.

Merge authorized by the maintainer's explicit instruction, subject to exact-head required CI and resolved conversations.

[yeongseon]

Reviewed exact head 5182566. All five required contexts completed/success; all SDK wheel and real local-host matrix cells passed in run 40339985318; no unresolved threads. Inspected logs: floor host resolves SDK 1.21.0; latest wheel resolves 1.25.0. Host endpoint asserts structured invocation fields and secure redaction with a synthetic canary. Open dependency bounds are explicitly guarded by latest-stable CI and do not claim future major certification. Merge authorized by the maintainer’s explicit instruction.