Changelog
34 tagged releases across 8 eras
Unreleased
Active hardening of the notification receiver contract — typed headers, deterministic dedupe, signature parsing.
- Typed header parsing + timestamp skew support
- Reusable sqlite dedupe primitives
- notify_receiver service hardened with strict verification + /stats + /ops aggregates
- Operator targets: make receiver-up, make receiver-stats
Notification reliability
End-to-end notification reliability — destinations, routing policies, ARQ delivery, DLQ persistence + replay, signature contracts.
- Signature parsing/verification + payload hashing primitives
- Compose-ready notify_receiver with deterministic fail modes
- E2E sender↔receiver tests covering happy path, retries, signature rejection, DLQ replay
- make notify-e2e + receiver contract runbook
- Deterministic webhook headers + optional HMAC signatures
- Attempt-level payload_sha256 persistence
- Tightened state machine with CAS claims and DLQ on max-age expiry
- Admin notification attempts endpoint + retry-now job control
- notification_routes table with deterministic matching
- notification_dead_letters persistence + admin replay APIs
- kill.notifications rollout kill switch for delivery storms
- Updated operability docs with route matching + DLQ replay flows
- KEYRING_MASTER_KEY_REQUIRED with deterministic failure codes
- AUTH_INACTIVE_KEY denial path + admin reactivation
- Compliance snapshot canonical schema + persisted artifact paths
- /v1/admin/api-keys lifecycle endpoints (expire/reactivate/revoke)
- /v1/admin/keyring expanded purpose support + activation lifecycle
- Compliance snapshot contract aliases + persisted evidence bundles under var/evidence
- Governance retention-proof APIs + status endpoint
- Notification destination routing with global fallback support
- ARQ worker for delivery; jobs/attempts as durable source of truth
- Forced control writes hardened with short-lived writer lease
- Background operability evaluator with distributed locking + heartbeats
- Durable notification jobs/attempts with retry backoff + dedupe windows
- Versioned forced-control flags with TTL and region-role enforcement
- /v1/ops/operability summary endpoint
Compliance + cost + SLA
SOC 2 control catalog snapshots, evidence bundles, perf harness, SLA engine, cost metering, alert + incident automation.
- Alert rules registry + deterministic evaluation APIs (/v1/admin/alerts/*)
- Incident automation lifecycle with timeline (/v1/admin/incidents/*)
- Operator action endpoints with idempotency + persisted records
- make preflight + make ga-checklist deploy automation
- Compliance control catalog snapshots + in-memory evidence bundle exports
- API key lifecycle hardening with optional expiration + rotation helper
- /v1/admin/keys keyring lifecycle APIs with encrypted-at-rest material
- make security-audit / security-lint / security-secrets-scan gates
- Reproducible load/soak harness with deterministic perf scenarios
- Capacity model + sizing guidance for standard/pro/enterprise tiers
- Noisy-neighbor fairness checks + perf report artifacts
- Tuned DB pooling controls + detailed timing instrumentation
- SLA policy engine with tenant assignments + incident tracking
- Runtime SLA enforcement on /v1/run + ingestion (warn/degrade/shed)
- Adaptive autoscaling profiles/actions + admin SLA APIs
- Cost metering + pricing catalog
- Tenant budgets with warn/block/degrade guardrails
- Admin/self-serve spend analytics + chargeback reports
- Quality datasets/runs/results + metrics trends
- Runtime quality guardrails + SSE quality events
- Release gate enforcement + override workflow
Identity + ABAC
Enterprise SSO (OIDC) + SCIM 2.0, ABAC policy engine with simulation, document ACLs with creator-owner default.
- Priority-aware deny-first / allow ABAC engine
- Document-level ACLs with creator-owner default
- Admin policy/permission APIs with simulation
- Tenant guard / RLS posture checks
- OIDC SSO with PKCE + state/nonce replay protection + JIT provisioning
- SCIM 2.0 endpoints with token auth + audit events
- Identity admin APIs (provider, token, tenant user)
- Entitlements + identity runbooks
- SOC 2 control catalog with continuous evaluation engine
- Evidence bundle generation/signing/verification
- Compliance ops posture endpoint + scheduling + retention pruning
- SOC 2 runbooks + compliance tests
Resilience + crypto
Envelope encryption with KMS rotation, governance + DSAR + retention pipeline, multi-region failover control plane.
- Tenant key registry + encrypted blob store for sensitive artifacts
- Envelope encryption with pluggable KMS providers
- Key rotation APIs with resumable re-encryption jobs
- Crypto runbooks + governance posture integration
- Retention policies, legal holds, DSAR requests, policy rules
- Policy-as-code engine with deterministic rule evaluation
- Retention execution/reporting with legal hold supersession
- DSAR APIs (export/delete/anonymize) with auditable lifecycle
- Region status + failover control plane tables/endpoints
- Readiness arbitration with split-brain detection
- Token-gated promotion/rollback flows + cooldown guards
- Write-freeze enforcement during failover
Reliability + DR
Reliability primitives (retries, breakers, bulkheads), kill switches, DR backups with signed manifests, BFF SSE protocol.
- DR backup/restore with signed manifests
- DR readiness/backups/restore-drill ops endpoints
- Backup retention pruning + drill reporting
- DR runbooks + tests
- Retries + circuit breakers + bulkheads
- /v1/ops/slo with availability + latency + error budget
- Rollout kill switches + canary controls
- Maintenance tasks + incident response runbooks
- /v1/ui BFF endpoints (bootstrap, dashboard, documents, activity, actions)
- Standardized cursor/filter/sort query contracts for UI lists
- Optimistic UI action contract with persisted records
- SSE sequence + heartbeat protocol + reconnect semantics
- Frontend TypeScript integration SDK
Enterprise primitives
/v1 versioned API + envelopes + idempotency keys, plan entitlements, tenant self-serve, quotas + 402 contract.
- /v1 versioned API with legacy deprecation headers
- Standardized success/error envelopes
- Idempotency-key support on write endpoints
- Improved OpenAPI schemas + generated SDK scaffolding
- Tenant self-serve API key lifecycle endpoints
- Usage summary + timeseries endpoints
- Plan visibility + upgrade request workflow
- Billing webhook test endpoint
- Tenant plan assignments + feature entitlements
- Server-side feature gating for retrieval/TTS/ops/audit/corpora
- Admin APIs for plan assignment + overrides
- Daily/monthly tenant quotas with soft/hard cap modes
- Quota response headers + 402 QUOTA_EXCEEDED contract
- Admin quota management + usage summary endpoints
Foundation
Streaming agent + SSE framing, multi-cloud retrieval routing, async ingestion, audit log, RBAC, rate limiting.
- Per-key + per-tenant dual enforcement
- Stable 429 schema with retry hints
- Audit events for throttling + degraded mode
- audit_events table + central audit service
- Auth/security/data mutation event logging across the API
- Admin-only audit query endpoints with tenant scoping
- Metadata redaction policy for sensitive fields
- API key auth with hashed key storage
- RBAC roles + tenant binding
- Protected run/documents/corpora/ops endpoints by role
- Auth/RBAC integration tests + tenant isolation coverage
- Redis-backed ARQ ingestion worker
- Enqueue-based 202 Accepted ingest semantics
- Document status tracking with failure reasons
- Worker heartbeats + queue depth status
- Lifecycle endpoints with metadata (source, reindex ts, storage path)
- Idempotent text ingest + delete + reindex flows
- Upload/status/list APIs with tenant scoping
- Deterministic chunking + embedding + pgvector storage
- Integration tests covering upload → ingest → retrieval
- Bedrock KB + Vertex retrieval adapters (mock-tested)
- Retrieval routing per corpus.provider_config_json
- Seed demo corpus configured for router defaults
- Streaming /v1/run with progressive token streaming
- SSE framing + request_id tracing + reconnect semantics
- DB session lifecycle hardening + race-safe upserts
- pgvector cosine retrieval with similarity scoring