v0.6.5 — Security hardening

Security release: closes the independent audit's High/Medium findings, plus a Python-first Getting Started rewrite and an audit-driven architecture cleanup. See PR #32.

Security (docs/SECURITY_AUDIT.md #1–#8)

• #1 IDOR (High): object-level ownership checks on all read endpoints (404, no existence leak).
• #2 Dev-login backdoor (High): fail-closed — requires explicit PORTAL_DEV_LOGIN=1; local compose binds the portal to 127.0.0.1.
• #3 apiserver SA (High): off the operator's cluster-wide SA (base → no-RBAC default; prod IRSA overlay unchanged).
• #4 Leaked token (Med): scrubbed from the sample notebook.
• #5 Ref validation (Med): server-side s3://-into-the-right-bucket checks block file://, bare paths, and cross-bucket reads.
• #6 Auth secret (Med): portal refuses to start in prod with an unset/placeholder BETTER_AUTH_SECRET.
• #7 Runner (Med): runs as non-root UID 10001.
• #8 Batch cap (Low): SP_MAX_BATCH_VARIANTS (default 10000).
• Also removed a production magic-link bearer token from an auth log line.

Other

• Getting Started now leads with the Python SDK (notebook + script views); REST is the no-Python fallback.
• Architecture cleanup: 24 safe behavior-preserving items (dead code, dedup, domain-language alignment, a failed-upload artifact-URI correctness fix).

⚠️ Operator action required

Rotate the two exposed sp_live_… API tokens and the Gmail SMTP app-password (the in-repo scrub does not revoke them), and remove gmail.com from production ALLOWED_EMAIL_DOMAINS.

🤖 Generated with Claude Code

v0.4.0 — architecture deepening + lockstep versioning

First release of the architecture-deepening work — giving domain concepts named in CONTEXT.md a single home, validated under worktree isolation and adversarial QA.

Highlights

• ADR-0011 — single-home Claim eligibility. app.eligible_simulations(version, cap) is the one home of the per-User claim-eligibility predicate, consumed by the Runner's claim (as a membership gate that preserves FOR UPDATE OF row locking — verified against PG16) and the KEDA scaler.
• ADR-0013 — guarded lifecycle SQL. claim_simulation / renew_lease / finish_simulation / reap_expired_leases own each running-phase transition and its runner_id fence; the Runner and Reaper are thin callers. Hard per-User cap verified (cap=1, 6 concurrent claimers → 1 wins).
• ADR-0012 — Content Hash pinned. A shared test vector asserts the Go and Python hashers can't drift.
• ADR-0014 — auth seam. API-key hash pinned by a shared vector across TS/Go; domain allow-list single-sourced.
• ADR-0015 — version source. Runner image tag derives from spec.EngineVersion; a config/versions.yaml catalog with a CI drift check.

Release engineering

• New hack/bump-version.sh (make bump-version V= / make check-package-versions) bumps the portal, Runner, and Python SDK in lockstep and fails loudly on a missed pattern.
• All packages unified at 0.4.0 (from 0.2.0 / 0.1.0 / 0.3.1).

Design rationale: ADRs docs/adr/0011–0015 and docs/architecture-review-2026-06.md.

Migrations: adds 0006_eligible_simulations.sql and 0007_lifecycle_functions.sql (idempotent; apply in order).

🤖 Generated with Claude Code