v0.8.1

What's Changed

• chore(helm): bump chart appVersion to v0.7.1 by @github-actions[bot] in #239
• chore(deps): go 1.26.3 + golang.org/x/net v0.53.0 (CVE bumps) by @pschleger in #241
• docs: correct stale isolation-level references to SI+FCW by @pschleger in #240
• docs: README + OVERVIEW→FEATURES + new help topics (admin, cluster) — evaluator-first refactor by @pschleger in #242
• feat(helm): optional separate migration DSN (migrate.postgres) by @pschleger in #268
• chore(deps): bump the minor-and-patch group across 1 directory with 8 updates by @dependabot[bot] in #267
• chore(deps): bump distroless/static from 47b2d72 to 3592aa8 in /deploy/docker by @dependabot[bot] in #248
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #245
• chore(deps): bump busybox from 1.37 to 1.38 in /deploy/docker in the minor-and-patch group by @dependabot[bot] in #266
• ci: run full CI battery on release/** branches by @pschleger in #269
• refactor(workflow): #250 split processor execution-location from scheduled-transition timing by @pschleger in #265
• chore(deps): target Dependabot PRs at release/v0.8.0 by @pschleger in #275
• chore(deps): bump go directive to 1.26.4 — stdlib CVE fixes by @pschleger in #279
• feat(iam): OpenAPI conformance for /oauth/keys/* (keypair + trusted) — closes #281 by @pschleger in #289
• feat(spi): tx-state sentinel errors — closes #200 by @pschleger in #294
• feat(grpc): wire ProcessorConfig.Context pass-through for Cloud parity (closes #253) by @pschleger in #297
• feat(workflow): tighten import-time validation (state graph, names, ExecutionMode enum) — closes #255 by @pschleger in #298
• feat(entity): grouped statistics query endpoint (closes #299) by @pschleger in #300
• feat(workflow): silent-default semantics — closes #256 by @pschleger in #302
• chore(workflow): import/export boundary hygiene sweep — closes #257 by @pschleger in #306
• test(workflow): import/export coverage sweep — closes #258 by @pschleger in #307
• feat(workflow): scheduled-transition configuration shape + SPI by @pschleger in #308
• feat(workflow): asyncResult + crossoverToAsyncMs SPI shape with import rejection — closes #261 by @pschleger in #309
• feat(workflow): RetryPolicy import-time validation + surface inbound retryable flag — closes #262 by @pschleger in #310
• feat(workflow): strict-decoder on import handler — closes #264 by @pschleger in #311
• feat(iam): OpenAPI conformance for /clients (technical users) by @pschleger in #312
• feat(iam): OIDC providers subsystem (#284) by @pschleger in #314
• auth help topic + v0.8.0 OIDC polish by @pschleger in #316
• feat(auth/oidc): #317 support object-shaped rolesClaim (Zitadel) by @pschleger in #318
• chore(help): use sort.Strings, drop hand-rolled insertion sort by @pschleger in #320
• chore(release): forward-port cyoda-platform → cyoda org-rename fix by @pschleger in #324
• feat(workflow): forward-port schema-version contract (#319) + bump 1.0 → 1.1 for v0.8.0 by @pschleger in #327
• chore(deps): bump mikefarah/yq from 4.53.2 to 4.53.3 in the minor-and-patch group across 1 directory by @dependabot[bot] in #325
• feat(workflow): client-owned annotations on workflows, states, and transitions by @pschleger in #329
• feat(observability): wire OIDC subsystem metrics (D22 follow-up to #284) by @pschleger in #331
• fix(test): unbuffered FaultInjectingKV pause channel (fix intermittent race deadlock) by @pschleger in #332
• release-prep v0.8.0: deps sweep, SPI v0.8.0 pin, GOPRIVATE fix, doc finalize by @pschleger in #333
• Release v0.8.0 by @pschleger in #334

Full Changelog: v0.7.1...v0.8.1

cyoda-0.8.1

cyoda-go: a lightweight, multi-node Go digital twin of the Cyoda platform. This chart ships a production-ready Helm deployment backed by an external Postgres, fronted by Gateway API (default) or a still-maintained Ingress controller (transitional).

v0.7.4

Changelog

• 9ba7b13 release: v0.7.4 (complete cyoda-platform → cyoda org rename in release pipeline)

v0.7.1

Changelog

• 39e3266 chore(release): drop replace directives; pin plugin modules at v0.7.1 (#238)

v0.7.0

Changelog

• 73e79f3 release: v0.7.0 — collection workflow routing + transactionWindow chunking + per-item ifMatch + COMMIT_BEFORE_DISPATCH (#231)
• 18d9d04 Merge pull request #225 from Cyoda-platform/release/v0.7.0
• c251674 docs(openapi): document asyncResult/crossoverToAsyncMs Cloud-parity gap (#223) (#224)
• 9cd4bc9 Merge pull request #221 from Cyoda-platform/release/v0.7.0
• e82171c docs(changelog): expand v0.7.0 entry to cover all 15 milestone issues (#220)
• a4f7f6f fix(release/v0.7.0): security-audit findings on supply-chain + concurrency (closes #218) (#219)
• 236b35e fix(release/v0.7.0): code-review findings on #210/#211/#213 (#214)
• 024de7d refactor(common): separate (status, code, retryable) axes in 4xx errors (#140) (#213)
• ddad755 docs(chart): dedicated guides for Ingress→Gateway migration + Gateway API policies (#57 #58) (#212)
• 5a1ffac fix(search): single-node invalidation + cross-tenant isolation in path cache (#174 #175) (#211)
• b3a2b65 feat(release): cosign keyless signatures on archives + verify in install.sh (#47) (#210)
• 7e35823 feat(fixtureutil): add LaunchCyodaClusterAndComputeWithBinaries (#157) (#209)
• fcbb726 test(parity): unblock #150/#152 skips — handler-param fixes already delivered (#208)
• 541498f fix(release): publish install.sh as a release asset + adopt stable URL (#49) (#207)
• 3003fec chore(deps): bump docker/setup-buildx-action from 3 to 4 (#206)
• 64ce242 docs(architecture): add CONCURRENCY.md (#199 PR-C3) (#205)
• ef16894 fix(postgres): tenant isolation across TM lifecycle surface (#199 PR-C2) (#204)
• 2a8c782 fix(sqlite): tx.OpMu coverage for Savepoint/RollbackToSavepoint + tenant isolation (#199 PR-C1) (#203)
• 9e8e0f1 chore(deps): bump cyoda-go-spi to v0.6.1 (#199 PR-B) (#202)
• 5c9cdf0 fix(memory): tx.OpMu coverage for Savepoint/RollbackToSavepoint/Join + tenant isolation (#199 PR-A) (#201)
• 29057e9 fix(memory): apply tx.OpMu locking discipline to remaining 6 in-tx ops (#176) (#198)
• 8bb7f49 fix(api): API-wide CORS support (#196)
• faeddc9 fix(openapi)!: #21 spec-server conformance — runtime validator, audit, defect fixes (BREAKING) (#195)
• 4abcea6 docs: add CHANGELOG.md with v0.7.0 entry + README versioning policy
• f1ee207 chore(deps): root go mod tidy after sqlite-plugin dep bump (#180)
• c344938 fix(conformance): address M-1 through M-7 minor review findings
• 7028cc7 fix(conformance): address I-1/I-2/I-3 review findings
• 1d037f6 docs: final consistency pass for openapi.md (Task 11.3 / #21)
• e85262f feat(e2e): flip openapi validator to ModeEnforce + final consistency pass
• 6ffaa7f fix(spec+e2e): final cleanup — content-type drift, enum mismatch, uncovered-op closure
• 6fe60de fix(search): reconcile spec with server, document ndjson streaming validator coverage
• 2d035ab fix(model): reconcile spec with server, declare error responses
• 85f1747 docs(audit): fill commit SHA e9d6985 for Task 7.1 messaging rows
• e9d6985 fix(messaging): JSON-in-string content + dead-branch removal + EdgeMessagePayload schema
• 38a1700 fix(e2e): add fallback path-template matcher for kin-openapi router overlaps
• 19aa18a docs(audit): note Task 6.1 embedded-spec update mechanism (commit 7ec63f3)
• 7ec63f3 fix(spec): update embedded swagger spec so GetSwagger reflects Task 6.1 changes
• 9f6f1a9 docs(audit): fill commit SHA 9c721b4 for Task 6.1 entity rows
• 9c721b4 fix(entity): reconcile spec with server (closes original #21 confirmed defects)
• 44a312c docs(audit): fill commit SHA 302ba1e for Task 5.1 transitions rows
• 302ba1e fix(spec+e2e): document missing transitions endpoints + skip operational paths
• 51120fc docs(audit): fill commit SHA 04d6721 for Task 4.1 audit rows
• 04d6721 fix(audit): reconcile spec with server, declare AuditEvent discriminator union
• 580d4aa fix(help): remove CQL Execution Statistics from tag list test
• bd98bd7 docs(audit): fill commit SHA 766df8b for Task 3.1 account/IAM rows
• 766df8b fix(account+iam): reconcile spec with server (decl. 501 for stubs per #194)
• 14a6b78 docs(audit): add per-operation OpenAPI conformance audit table
• 444103c fix(e2e): harden validator against streaming-body panic + spec context-path
• 95e3589 feat(e2e): wire openapi validator into TestMain + conformance test (record mode)
• fc99fd4 refactor(e2e): route all test requests through e2eNewRequest helper
• 77bc07e feat(e2e): add markdown report writer for conformance findings
• 2565ca7 feat(e2e): add validator middleware with mode-aware enforcement
• 25c59e1 docs(plan): correct Options struct placement in Task 1.5 spec
• dbd8c99 feat(e2e): add Validator with kin-openapi response validation + fixture suite
• 65214bc feat(e2e): add mismatch collector with exercised-ops tracking
• 1acba43 feat(e2e): add WithTestT/TestTFromContext for per-request test capture
• d09ecfc fix(e2e): drop dead teeFR/teeFHR variants + simplify capture-test
• 7ac3de9 feat(e2e): add tee-writer that delegates Flusher/Hijacker/ReaderFrom
• 54e92e8 fix(e2e): reorder mode.go declarations + drop duplicate package comment
• 2e47db5 feat(e2e): scaffold openapivalidator package with Mode constant
• 7101dcb docs(plan): add implementation plan for #21 OpenAPI conformance
• 4ecffd3 docs: revise #21 design after review-04 (2 nits) — convergence reached
• 3375537 docs: revise #21 design after review-03 (storage invariant + 3 moderates)
• 4d8c0af docs: revise #21 design after review-02 (Go test mechanics + 5 strong concerns)
• d51ffdb docs: revise #21 design after fresh-agent review
• fd0ec61 docs(spec): add design for #21 OpenAPI server-spec conformance
• 315f8f9 docs(adr): add 0001 OpenAPI server-spec conformance approach

cyoda-0.6.3

cyoda-go: a lightweight, multi-node Go digital twin of the Cyoda platform. This chart ships a production-ready Helm deployment backed by an external Postgres, fronted by Gateway API (default) or a still-maintained Ingress controller (transitional).

v0.6.3

Changelog

• 7f2746d Merge pull request #177 from Cyoda-platform/release/v0.6.3
• 6e1ebe7 fix(test): make TestShutdown_SecondSignal_ForcesHardExit deterministic on slow CI (#178)
• 8a91438 fix(auth): v0.6.3 auth-hardening sweep (6 findings) (#173)
• d3ef180 fix(search): negative cache for unknown field-path validation (#172)
• dae33c6 chore(auth): drop unused parseRSAPublicKeyFromPEM helper (#169)
• 50b12ca test(parity): add point-in-time / transactionId client helpers (#132) (#161)
• 25e70a2 feat(search): wire pre-execution field-path validation with bounded refresh (#77) (#162)
• 5d6ccfd fix(entity): emit INCOMPATIBLE_TYPE for leaf type mismatches (#129) (#160)
• 0504e44 test(e2e): pin cross-tenant invisibility for ?pointInTime and ?transactionId (#171)
• 436904b fix(security): cap validator recursion depth (H4) (#170)
• c7d9e21 fix(entity): GetOneEntity now honors transactionId query param (#150) (#165)
• 2dfff72 fix(entity): propagate pointInTime in GetEntityChangesMetadata (#152) (#164)
• b4dd489 fix(auth,admin): trusted-key + auth/admin error hardening (#34 items 2-7, #68 item 14) (#159)
• 08d772a fix: app startup-failure and shutdown lifecycle (#10, #34, #68, #26) (#158)
• c86afc8 fix(model): emit INVALID_CHANGE_LEVEL on set-change-level invalid enum (#130) (#156)
• 4ae1ccf fix(auth): uniform 401 message + structured reason log (#68 item 12) (#155)
• 94ec3cc fix(workflow): return 404 MODEL_NOT_FOUND on import for unknown model (#131) (#154)
• db24706 fix(memory): hold tx.OpMu.RLock around tx-state mutations in Save and CompareAndSave (#153)
• 8c5e9b2 test(auth): cross-issuer JWKS signature-confusion regression (#68 item 9) (#151)
• e5a1a5c fix(search): explicit pageNumber cap and bits.Mul64 offset overflow (#68 item 10) (#149)
• 524c076 fix(sqlite): derive CountByState IN-clause cap from SQLITE_MAX_VARIABLE_NUMBER (#68 item 11) (#148)
• 94ca1df fix(docker): pin distroless/static base image by digest (#147)
• 67bc5f5 chore(ci): security hardening for v0.6.3 (#168)
• f7bc7ee docs(plan): v0.6.3 outstanding fixes implementation plan (#146)
• 2722738 fix: specific dictionary error codes for model lifecycle and If-Match (#128) (#141)
• 3f172ff fix(common): make Conflict() non-retryable; add RetryableConflict() for TX aborts (#126) (#127)
• 709a86b test: external API scenario suite — tranche 4 (#121) (#138)
• 8fe5005 test: external API scenario suite — tranche 3 (#120) (#135)
• 215918f test: external API scenario suite — tranche 2 (#119) (#133)
• 6164b82 test: external API scenario suite — tranche 1 (#118) (#125)
• d6a1fe5 chore(helm): bump chart appVersion to v0.6.2 (#117)

v0.6.2

Changelog

• 27bdff5 Merge pull request #116 from Cyoda-platform/release/v0.6.2
• 893f924 fix(v0.6.2): review follow-ups across #112 / #114 (#115)
• f0c39a8 feat(help): add cloudevents topic + cyoda help cloudevents json (#113) (#114)
• ed5908b feat(help): per-tag OpenAPI filtering (#111) (#112)
• f158fb2 chore(deps): bump the go_modules group across 2 directories with 2 updates (#110)
• 59fc007 chore(helm): bump chart version and appVersion to 0.6.2 (#109)
• 66f5e32 build(ci): aggregator for plugin submodule tests (#46) (#108)
• ef5380b feat(entity): implement PUT /api/entity/{format} collection update (#92) (#107)
• 7ba5859 fix: search/entity batch (#79 #90 #93 #94) (#106)
• 860d2c8 fix: security batch (#97 #98 #99 #100) (#105)
• e34d5f4 fix(release): drop brew post_install; revise caveats (#96) (#104)
• cb6cc1f fix(cluster): gossip.Register honors ctx / CYODA_STARTUP_TIMEOUT (#9) (#103)
• a29a3fb fix(release): stamp version on help-JSON goreleaser hook (#101) (#102)

v0.6.1

Changelog

• 60c6cc2 feat: cyoda help subsystem (v0.6.1 Phase 1) + --version flag (#89)

v0.6.0

Changelog

• 217e1a4 fix(release): pin goreleaser to the triggering tag via GORELEASER_CURRENT_TAG