InterLock 1.0.0-rc.18

The first release built in the public repository. Its image and chart carry
GitHub build provenance attestations as well as cosign signatures; earlier
release candidates were built while the repository was private and are
cosign-signed only.

Security

• pymongo 4.18.2 (CVE-2026-88029, CVE-2026-96747, CVE-2026-96748,
  CVE-2026-96749) in the optional connectors-tier2 extra; the published
  image does not include it.
• fsspec 2026.9.0 (GHSA-27vj-qcqg-25rc: un-sandboxed Jinja rendering of
  Kerchunk reference documents) and multidict 6.9.1 (GHSA-54p9-h82j-f925:
  unbounded memory growth through the items-view operators), both transitive
  dependencies of the published image.

Fixed

• The console's "Identity created" page showed a PostgreSQL connection command
  that put the API key in the user name with no password, so psql prompted
  instead of connecting, and named localhost:5432, which is not where the
  Compose quick start publishes the gateway. It now passes the key as the
  password, with the gateway host and port left for you to fill in.

Documentation

• The README describes who InterLock is for, the problem it solves, how a
  request is decided, the tested agents, what InterLock stores, and its
  current operating boundaries.

InterLock 1.0.0-rc.17

Documentation

• The AWS (EKS) release gate is closed: 1.0.0-rc.16 was certified on EKS by
  the cloud-certification workflow (35/35 governed-core tests, readiness held
  after an upgrade re-install, full teardown), with two rehearsals of the EKS
  guide from zero as supporting evidence. The cloud certification page now
  lists the AWS prerequisites, including the OIDC subject format a
  repository with immutable subjects issues.

InterLock 1.0.0-rc.16

Added

• The AWS Terraform root can create a managed data tier
  (managed_data_tier = true, off by default): a private RDS PostgreSQL
  control database whose master credential stays in Secrets Manager, and a
  TLS-only ElastiCache Valkey cache, both reachable only from the cluster's
  nodes. node_capacity_type keeps Spot as the default and lets a kept
  deployment choose on-demand nodes.

Fixed

• EKS clusters from the Terraform could never run InterLock: with no EBS CSI
  driver, the gateway's audit-spool volume never bound and the install timed
  out. The cluster now installs the driver with an EKS Pod Identity role.
  Node root volumes were silently 20 GiB; they are now 50 GiB gp3.
• The certification workflow's AWS job read the DigitalOcean job's state
  bucket variable, and its one-hour AWS session could expire before the
  destroy step, leaving the cluster running. It now has its own
  TF_STATE_AWS_* variables and a three-hour session.

Security

• The secret scan now catches rediss:// URLs with an empty username (the
  ElastiCache AUTH form) and RDS and ElastiCache endpoint names.

Documentation

• Two AWS deployment guides: an EC2 instance with Docker Compose, and Amazon
  EKS with RDS, ElastiCache and a Network Load Balancer, without a domain
  (the gateway uses a certificate from a private CA). Both were rehearsed
  from zero and torn down. The EKS rehearsal also proved readiness recovering
  by itself after an ElastiCache reboot, S3 access through EKS Pod Identity
  with no stored keys, and Codex CLI and the google-genai SDK connecting
  through the private CA.

InterLock 1.0.0-rc.15

Fixed

• After a Redis restart, the gateway and admin could stay unready until
  their pods were restarted. The cache-invalidation and FAISS pub/sub
  listeners caught the dropped connection, then failed in their own cleanup,
  which sent UNSUBSCRIBE to a server that was still down; the listener ended
  and /ready reported it unhealthy for good. On the DigitalOcean rehearsal a
  managed Valkey restart left both services serving 503 for about 41 hours.
  The listeners now close a dropped subscription without that command, never
  let a cleanup error escape, and resubscribe when Redis is back. An
  end-to-end test restarts Redis and requires both services to become ready.

Changed

• Dependency updates: 25 patch releases (among them pydantic 2.13.5,
  cryptography 50.0.2, joserfc 1.7.5, msgpack 1.2.3, snowflake-connector
  4.8.0), OpenTelemetry 1.45 / 0.66b0, authlib 1.8.0 (minimum now 1.7.1, the
  fix for two open-redirect advisories in its OAuth server code, which
  InterLock does not use), and the ml extra's torch 2.14.1, transformers
  5.18.0, faiss-cpu 1.15.1 and spaCy 3.8.16. sentence-transformers stays on
  5.x.

Documentation

• The MCP clients guide covers Codex CLI, the OpenAI Responses API, the
  Gemini Interactions API and google-genai SDK, and the Anthropic API's MCP
  connector, each with a working configuration, and records what was tested
  against a live deployment on 2026-10-04 and how each client shows a refusal.

InterLock 1.0.0-rc.14

Security

• PyJWT moves from 2.13.0 to 2.15.1. Ten advisories published against 2.13.0
  (fixed in 2.14.0) failed the dependency audit on every build. PyJWT reaches
  the image through the GitHub, Redis, Salesforce and Snowflake client
  libraries.
• urllib3 moves from 2.7.0 to 2.8.0, for three advisories fixed in 2.8.0.
  InterLock depends on it directly, and through requests, botocore and
  PyGithub.
• oauthlib moves to 4.0.0 and sentence-transformers to 5.7.0, for one
  advisory each. Neither is in the published image: oauthlib comes with the
  Atlassian connectors' client library and sentence-transformers with the
  ml extra, but the release preflight audits both.

Added

• make smoke-eval runs the quick start as an acceptance test: from an empty
  Compose project it signs in with the default password and changes it,
  registers the sample database through the wizard, grants an agent the read
  role, and checks the redacted rows over both protocols, a refused DELETE
  and the audit record. CI runs it beside the end-to-end suite. The evaluation
  guide now has two tracks: start from empty, or explore the seeded demo.

Fixed

• MCP recorded the client's X-Correlation-ID only on failed calls; served,
  cached and denied calls were audited under a new random ID, so the ID a
  client sent could not find its request in the audit log. Every MCP audit row
  now carries it. Found by make smoke-eval.
• The same SQL from the same agent over MCP and then over the PostgreSQL wire
  protocol shared one cache entry, so the second read got the first's format:
  psql received MCP's JSON and failed with lost synchronization with server, and an MCP agent could receive PostgreSQL wire bytes as its result.
  The cache key now includes the protocol (key format v6, so existing entries
  become misses), and each protocol checks a cached entry's format before
  serving it. Reported by an independent evaluation of rc.13; covered by
  end-to-end tests that compare the rows psql and MCP decode, in both orders.
• A redacted answer served from cache was audited with pii_detected false,
  because no scanner ran on the hit. The redaction applied when the answer was
  cached now travels with the entry in both cache tiers, and PostgreSQL, MCP
  and HTTP cache hits record it; the event page marks it as redaction from
  when the answer was cached.
• The audit event page showed an empty correlation ID, which lives in the
  request metadata, and printed policy decisions and metadata as Python
  dictionaries; both now render properly. The CSV export gains protocol and
  correlation_id columns (appended, so existing columns keep their
  positions), and Audit & Costs gains the protocol filter the docs
  described.
• An MCP query the database rejected, such as one naming a column that does
  not exist, returned only tool execution failed. Query errors (SQLSTATE
  classes 42, 22, 23 and 0A, and the MySQL equivalents) now return their code
  and the database's primary message, as a readable isError result for
  handshake clients and -32602 with the text for modern ones. Connection and
  server errors stay opaque. Both carry a correlation ID that matches the
  audit event.
• The console could not register a source on a private network, such as the
  quick start's sample database, because only the API could set
  allow_private_egress. The new-source form, the wizard and the edit page now
  have an Allow a private network address option, with the same rules as
  the API.
• The quick start stays in the console: the sample database is registered
  through the wizard with the private-network option, the wizard's default
  read role is the agent's role (the old step that asked for one hand-made
  statement did not match the role editor), both protocols run the same
  statement, psql runs inside the stack, the refused write is shown over MCP,
  and a port override is given. Compose no longer warns about the optional
  Anthropic and Mistral keys; the guide says no model key is needed.
• HTTP sources can set probe_path, the route Test Connection requests,
  for APIs whose root answers 404; a failed test now names the path it
  requested. It must be a path on base_url.
• Connector pages and the console call a connector's status its
  implementation, separate from release status, and a semantic cache
  strategy says semantic serving is disabled. The MCP tools reference names
  the source-role action each tool needs.
• The console's browser tab now follows sidebar navigation instead of staying
  on the first page's title, and no longer prints that title in the page.
• Docs: readable sidebar labels for guide groups; the testing page says
  make load needs Docker and deletes its project's volumes; contributor
  notes moved out of known limitations, and its release-gate line is current.

Documentation

• Two DigitalOcean deployment guides: an evaluation on one Droplet with Docker
  Compose, reached through an SSH tunnel, and a production deployment on DOKS
  with Managed PostgreSQL and Valkey, Traefik and Let's Encrypt. Each was
  followed from an empty account to a governed, redacted query and torn down.
  The DOKS guide sizes PostgreSQL by connections: six pods with the default
  pool exhaust the 1 GB plan, so it uses the 2 GB plan and a pool of 4.
• The documentation site is published at https://interlock.contextdata.dev by
  DigitalOcean App Platform, from the spec in .do/docs-app.yaml, and is rebuilt
  from main on every push. Canonical URLs and the sitemap use that address;
  DOCS_SITE_URL builds for another.
• The DigitalOcean (DOKS) deployment and live certification gate is closed:
  v1.0.0-rc.13 was deployed from its signed digests to a disposable cluster,
  certified (35/35 governed-core end-to-end tests, readiness across an upgrade)
  and torn down by the automated workflow. The release process page cites the
  run, the date and both digests.

InterLock 1.0.0-rc.13

Security

• A disabled source kept serving cached answers. Disabling or deleting a
  source removed it from the gateway's registry, but the MCP query handler
  consulted the cache before the registry, so any statement cached while the
  source was enabled was still answered afterwards; only new statements were
  refused. The handler now refuses an unknown source before the cache, an open
  PostgreSQL-wire session ends with 3D000 on its next message, and a registry
  reload clears the cache and connection pools of every source it stops
  loading. The admin console also clears a source's cache when it is edited,
  disabled or deleted, using the gateway's generation prefix: it had been
  advancing a counter under a default prefix no gateway read.

• The HTTP proxy ignored a source's cache strategy. It always used the
  gateway-wide strategy, so a source set to bypass was still cached over
  HTTP. It now resolves the source's own strategy, and a miss no longer falls
  through to the shared L2 cache.

Added

• A fresh install can be signed in to. With no admin yet, the console
  creates admin with the default password admin. That account reaches only
  the new change-password page until it sets a password of at least 12
  characters that is neither the default, its username nor the current one;
  HTML is redirected there, htmx gets HX-Redirect, and API calls answer 403
  password_change_required. INTERLOCK_ADMIN__BOOTSTRAP_PASSWORD still
  chooses the first password, and is not forced to change. Previously the
  quick start produced no login at all unless that variable was set.

• Admins can change their own password at /auth/change-password, linked
  from the sidebar. The change is throttled, audited as password.change
  (fail-closed), and revokes every other session of that admin: migration 019
  makes a password change bump authorization_version.

Fixed

• The quick start works as written: docker compose up needs no
  config.yaml, the admin console keeps a stable signing key across restarts,
  and every published port binds to 127.0.0.1. The unused 8080 mapping is
  gone.

• The Helm chart's default image is the chart's own appVersion instead of a
  hardcoded 1.0.0-rc.1, and the chart names its home, sources and
  maintainers.

• The Salesforce and Google Workspace client libraries (Apache-2.0) are in the
  published image, so those connectors no longer fail on a missing import.

• Install hints name the real package (interlock-runtime[pii],
  interlock-runtime[otel]), OpenTelemetry reports the running version, and
  CI measures coverage of interlock rather than the pre-rename namespace.

Documentation

• The documentation is a developer guide. It is now a Starlight site in
  docs-site/, organised as Get started, Concepts, Guides, Reference,
  Operations and Project. The quick start runs a sample database with
  docker compose --profile quickstart up and reaches a governed, redacted,
  audited query in a few steps, all verified against a fresh install. The
  reference for configuration, the admin API and its roles, MCP tools,
  connectors, role conditions, feature status and make targets is generated
  from the code and checked for staleness in CI. Contracts and runbooks moved
  into the site unchanged in substance and remain normative; the old docs/
  paths are mapped in docs/README.md. The README is a short introduction.

• Corrected while rewriting: a Vault reference is vault://path/key (the
  setup guide showed a #key form the resolver never read); the policy
  classifications condition is documented as matching no agent traffic today;
  adding admin accounts beyond the first needs SQL, now documented.

• Corrected claims the code does not back: policy redact_columns is applied
  to MCP and HTTP responses but not on the PostgreSQL wire, where only the PII
  scanner redacts; S3 and Spaces have no reachable governed write in V1; GitHub
  is active by default but its governance is not exercised by any test stack.
  The README's ports, admin roles, psql usage, extras and layout match the
  code.

• NOTICE describes the published image as it is: permissive licenses plus
  LGPL-3.0 (PyGithub, python-gitlab) and MPL-2.0 (certifi, tqdm, orjson), and
  the vendored htmx (BSD-2-Clause) and fonts (OFL). make license-report
  installs exactly what the image installs, writes a per-package inventory,
  and fails on any license outside that position.

• This changelog is split into one section per release candidate.

• SECURITY.md names a private contact, security@contextdata.ai, alongside
  GitHub private vulnerability reporting, with response times and supported
  versions. Issue creation links to it.