Open-RAIC v0.9.3

Open-RAIC v0.9.3

This is the first tagged release after v0.9.1. It includes the merged and deployed, but untagged, v0.9.2 stabilization work and the subsequent classroom, provider, and dependency fixes.

What changed

• Strengthened Google identity, logout, session, and readiness handling from the v0.9.2 stabilization work; retained provider governance and the existing Postgres storage model.
• Sanitized stored and rendered formulas, validated outbound provider destinations and redirects, and made quiz grading and ungraded feedback more reliable.
• Improved the no-key classroom demo and smaller-screen lesson layout, added a clear lesson-complete summary, preserved widget playback through mobile overlays, and bounded TTS responses.
• Updated Next.js to 16.3.8 and compatible dependency resolutions. braces@3.0.3 still has an upstream high-severity advisory with no fixed npm release. A local depth-limit patch is applied; the low-threshold dependency gate verifies its exact patch, lock binding, installed bytes, and behavior, and reports it as locally mitigated. GitHub currently shows that one open alert.

Release proof

• Source commit: 30afd159c206c9b6abd5e9af99897847e29fd9b8 (tree 5174cf314554493a340b2b63e33e32164e7dae42). GitHub CI passed all four jobs for this commit.
• A clean Node 24.19 / pnpm 10.28 ops:verify passed: dependency gate, localization, formatting, lint, TypeScript, 1,325 unit tests (3 existing skips), production build, 97 MiroFish contract tests (2 skips), 3 MiroFish browser flows, and 47 general browser flows (1 skip). A fresh four-budget synthetic benchmark and Node 24 Alpine Docker build also passed.
• Protected Preview dpl_AfbTNhokxn2si7RpDW68XKXa7mQV reached READY, preserved its SSO redirect, returned healthy version 0.9.3, and passed the no-key demo through quiz feedback and completion at desktop and phone width. Its source was a CLI upload with matching candidate metadata; Git provenance is established by the production deployment, not by that metadata.
• Git-triggered production deployment dpl_o3QKYbAWij8k6CgVaRfbCjALTFWK is READY, reports the source commit above, and owns open-raic.com. Live health returned version 0.9.3 with auth, encryption, and Postgres ready. The production milestone smoke passed 12 checks (4 optional features skipped); the classroom guard smoke passed 3 automated checks. The live no-key lesson completed with a 2/2 quiz result and no console warnings.

Limits and rollback

Signed-in teacher generation, share/join, scheduling, and source-document upload were not independently completed for this release. The protected Preview has no configured source-document smoke secret, and the production smoke lists five signed-in classroom steps for operator review. No paid model call or real student data was used in this release check. MiroFish, TTS, video, and web search are optional capabilities and are not enabled as release requirements.

If this application build regresses, restore the previous known-good production deployment dpl_HFVsa83hvR4H1aRbuapZpMDTG4NA at commit 2aa083cddb237cd5e7f55de953abb9029d898c41, then recheck the domain and health endpoint. Application rollback does not reverse database writes or external provider effects.