v1.1.0: Architecture Rewrite — Simpler, Stronger, Future-Proof

[Alberto-Codes]

We Rewrote the Architecture (and Deleted 85% of the Code)

When we launched v1.0.0, EncryptedSessionService reimplemented ADK's entire database layer from scratch — ~800 lines of raw SQL, custom schema, manual state merging. It worked, but it was fragile. Every ADK update was a potential breaking change. We were maintaining a parallel database engine just to add encryption.

v1.1.0 fixes that. We rewrote EncryptedSessionService as a thin wrapper around ADK's own DatabaseSessionService. Encryption now happens transparently at the SQLAlchemy column level via an EncryptedJSON TypeDecorator. No custom SQL. No schema ownership. No reimplemented state logic.

What Changed

• Architecture rewrite — EncryptedSessionService now subclasses DatabaseSessionService instead of BaseSessionService. ~800 lines of raw aiosqlite → ~130 lines of wrapper code.
• EncryptedJSON TypeDecorator — encrypts/decrypts at the ORM column level. ADK reads and writes normally; data hits disk encrypted.
• Full conformance tests — new test suite proves our service matches ADK's DatabaseSessionService behavior exactly.
• Runnable example — examples/basic_usage.py runs a real multi-turn ADK agent with Ollama and proves encryption at rest by inspecting the raw database.

What Didn't Change

• Your code. The public API is identical. create_session, get_session, list_sessions, delete_session, append_event — all the same.
• The encryption guarantees. State and conversation history are still encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256).
• The envelope protocol. Self-describing binary envelopes for future key rotation and backend migration.

Why It Matters

Less code = fewer bugs. Delegating storage to ADK = resilience to upstream changes. We own only the encryption layer now — which is what this project should be.

Migration

The constructor API changed from (db_path, backend, backend_id) to (db_url, backend). Existing v1.0.x databases are incompatible — create a fresh database when upgrading. See the migration note in the README.

Try It

pip install --upgrade adk-secure-sessions

from adk_secure_sessions import EncryptedSessionService, FernetBackend

async with EncryptedSessionService(
    db_url="sqlite+aiosqlite:///sessions.db",
    backend=FernetBackend("your-secret-passphrase"),
) as service:
    session = await service.create_session(
        app_name="my-agent", user_id="user-123",
        state={"api_key": "sk-secret", "patient_name": "Jane Doe"},
    )

What's Next

• AES-256-GCM backend (Epic 3) — NIST-recommended authenticated encryption
• Key rotation — zero-downtime re-encryption with the new architecture
• Full Roadmap

Links

• Documentation
• Getting Started
• PyPI
• GitHub
• v1.1.0 Release Notes
• ADR-007: Architecture Migration