0.34.0

v0.34.0

47 changes · 4 Bugfixes, 9 New Features, 34 Chores · 4 points.

Bugfix

• RADD-1066 /health reports version 0.1.0 while running 0.33.0
  Symptom: GET /health on the live instance returns {"status": "ok", "version": "0.1.0"} while the cluster runs git.radd-hq.com/radd/radd:0.33.0 — the version field has been a stale hardcode for roughly thirty releases. Noticed during the v0.33.0 rollout verification, 2026-08-12.
  8c35e347
• RADD-845 PAT-authenticated requests can leak an idle-in-transaction DB session for hours
  , with the evidence. During the v0.18.0 deploy (2026-08-04), the migration's DROP TABLE team_members sat blocked for 15+ minutes behind two sessions that were idle in transaction for 4h11m and 5h32m, both showing SELECT api_tokens.id, api_tokens.user_id, … as their last query — a PAT-authentication read that began…
  auth infra mcp · a315975a
• RADD-1074 Validation graphs read as finished: feedback badges and terminal caps on finding-producing ports
  Symptom (Hussein, 2026-08-13): an ai.validate node with unwired fail/unavailable ports looks unfinished — the canvas's visual language (learned from event graphs, where a dangling port IS inert) implies an action must follow, when in fact reaching fail already recorded the findings that reach the submitter. It…
  c23cf57a
• RADD-1074 Validation graphs read as finished: feedback badges and terminal caps on finding-producing ports
  Symptom (Hussein, 2026-08-13): an ai.validate node with unwired fail/unavailable ports looks unfinished — the canvas's visual language (learned from event graphs, where a dangling port IS inert) implies an action must follow, when in fact reaching fail already recorded the findings that reach the submitter. It…
  68bdc6fd

New Feature

• RADD-677 TOTP recovery codes
  MFA (spec 48) has no recovery path: a lost authenticator means an admin reset. Standard practice is a one-time recovery code sheet generated at enrollment.
  auth · f6d871bc
• RADD-1073 Builder UX: node names, topology-aware token picker, generate config, vars in the Test panel
  the inspector gains a name field on producing nodes (auto-suggested, uniqueness surfaced inline); TokenReference becomes topology-aware — it offers event/item roots plus exactly the outputs of nodes UPSTREAM of the node being edited (computed from edges), with insert-on-click; item-bound action value editors accept…
  ce6e2e14
• RADD-1072 ai.generate: one structured model call producing named outputs
  a third AI automation node (siblings: classify routes, validate judges — generate PRODUCES). Config: prompt, the shared context-include toggles, and an admin-defined output schema — a list of fields, each free-text or enum-constrained (enums forced at the model level via complete_structured, reusing the classify…
  b5be598c
• RADD-1071 Token resolution: one namespace, tokenized action values, miss-skip semantics
  the existing {{…}} rendering in action params unifies with node outputs — event/item roots plus {{<node_name>.<field>}} from the packet's bag. Item-bound action VALUE params (set_state, set_priority, set_assignee, set_team, set_cycle, set_release, set_custom_field, add_label/remove_label) become…
  d33c5c3c
• RADD-1073 Builder UX: node names, topology-aware token picker, generate config, vars in the Test panel
  the inspector gains a name field on producing nodes (auto-suggested, uniqueness surfaced inline); TokenReference becomes topology-aware — it offers event/item roots plus exactly the outputs of nodes UPSTREAM of the node being edited (computed from edges), with insert-on-click; item-bound action value editors accept…
  b1529043
• RADD-1072 ai.generate: one structured model call producing named outputs
  a third AI automation node (siblings: classify routes, validate judges — generate PRODUCES). Config: prompt, the shared context-include toggles, and an admin-defined output schema — a list of fields, each free-text or enum-constrained (enums forced at the model level via complete_structured, reusing the classify…
  892bfac3
• RADD-1071 Token resolution: one namespace, tokenized action values, miss-skip semantics
  the existing {{…}} rendering in action params unifies with node outputs — event/item roots plus {{<node_name>.<field>}} from the packet's bag. Item-bound action VALUE params (set_state, set_priority, set_assignee, set_team, set_cycle, set_release, set_custom_field, add_label/remove_label) become…
  df497277
• RADD-1070 Engine: node names, packet variable bags, and the output registry
  nodes gain an optional name (auto-suggested slug, unique per graph, validated on write — lenient on read per the module's convention; renaming a node whose name is referenced by downstream tokens is caught at save). Packet gains a variable bag {node_name: {field: value}} — branches copy it, merges union it…
  e62371f5
• RADD-1067 orjson serializes every API response
  Wanted (Hussein, 2026-08-12, out of the v0.33.0 SBOM review): the one remaining clearly-worthwhile Rust swap — API responses currently serialize through stdlib json, the slowest pure-Python step left on the hot read paths (boards, lists, search), while validation/crypto/tokenization already run native. Decided in…
  881bcb42

Chore

• RADD-1109 First-contact fixes: the participation surface must not contradict itself
  a first-contact review (an agent reading the tree as an outside contributor, 2026-08-17) found the participation surface contradicts itself even though the product docs are excellent:
  docs release · 2 pts · fec4c092
• RADD-1107 The provenance scrub missed what has no name in it: round-2 residue sweep
  a second-round ship-safety sweep (2026-08-17, adversarial agent over git ls-files) found residue the RADD-1076 scrub and the publish gate both miss — because none of it contains a denylisted NAME:
  release · 2 pts · c24c7f3b
• RADD-1100 Page templates become a real feature: authoring UI + apply-on-create
  the /page-templates CRUD family + pages/templates.py + model exist with zero clients and zero tests — a feature someone started and nothing finished. Disposition decided 2026-08-15: build it rather than delete it.
  pages web · f74dfa32
• RADD-1096 The webhooks management API has zero callers — a secret system with no door
  , with the evidence. Every route in webhooks/router.py (endpoint CRUD + GET /webhooks/{id}/deliveries) has no callers anywhere: no SPA fetch (no webhook entry in web/src/lib/constants/api.ts; every SPA "webhook" mention is Forgejo receivers or the automations send_webhook action), no MCP tool, no SDK use, and…
  ux web webhooks · 2ade80ac
• RADD-1101 Operator endpoints get their buttons: reindex, plugin install/uninstall, local-embed catalog, JQL test
  four working operator endpoints are reachable only by curl: POST /pages/reindex (link-index rebuild), POST /plugins/{id}/install + /uninstall (the plugins page offers only enable/disable), GET /ai/local-embed (the local-embed model catalog — flagged by three consecutive audits), and POST /jira/preview (JQL…
  settings ux web · 4a1b0940
• RADD-1098 modules.md and the codebase-scan docs tell yesterday's truth: ~25 verified-stale claims
  the designated source-of-truth docs contradict the code, verified claim by claim by the ghost-hunt workflow (HEAD c670f0c). The 200-cap bullets were fixed this morning (RADD-687); these are the NEXT layer:
  docs · deb35208
• RADD-1099 The public KB portal gets its search box
  GET /public/pages/search is served (spec 74) and the SPA even carries its ApiPath.publicKbSearch constant — but the /kb portal renders no search input, so public deflection works only by browsing. Found by the ghost hunt; disposition decided 2026-08-15: build the box.
  pages web · 9f73c4f8
• RADD-1105 JiraRun.plan_snapshot appears in the run report
  every import run snapshots its plan into JiraRun.plan_snapshot and nothing ever reads it — a run report can't answer "what mapping produced this?". Decided 2026-08-15: surface it (the confluenceimport report is the precedent).
  import web · 3faff178
• RADD-1104 Automation save-time validation returns: isActionValid joins the graph's canSave
  RADD-914's graph rework orphaned isActionValid — rules with incomplete action params now save-attempt and bounce off the server's 422 instead of the editor refusing up front (the disable-up-front rule says never edit-then-error). Decided 2026-08-15: rewire it.
  automations web · 7048438f
• RADD-1103 member.update gets the role-change route it has always advertised
  member.update is minted by the member CrudResourceSpec, grantable, listed in the SPA's permission catalog — and enforced nowhere: changing a member's role is delete-grant + create-grant, which needs BOTH other atoms and produces two history events for one intent. Decided 2026-08-15: build the route.
  api auth · ab8998c4
• RADD-1102 Estimate edits go realtime: emit under TimelogEntity.ITEM_ESTIMATE
  set_estimate/clear_estimate emit nothing, so the SPA's item_estimate realtime mapping (realtime.ts:39) is unreachable — another user's estimate edit never invalidates your board. Decided 2026-08-15: wire it, don't delete it.
  realtime timelogging · f77073c2
• RADD-1093 Monitoring shows retired consumers as permanently Stalled — attachments.gc is a ghost offset row
  , with the evidence. Settings → Monitoring shows attachments.gc as Stalled, 21,813 events behind, last movement 12d. It is not stalled — it no longer exists. RADD-745 folded the standalone attachments/comments GC consumers into the unified events.cascade consumer, but nothing retired the old consumer_offsets…
  bug events monitoring · cbbe874f
• RADD-1095 Personal API tokens have two settings homes — pick one
  the same TokensPanel renders on Settings → Profile (profile.tsx:100-106, under an "API tokens" section) AND as the dedicated Settings → API tokens page (tokens.tsx), both registered in the Account nav (settings/layout.tsx:81 and :91). TokensPanel.tsx:64's own comment admits it: "(kept as its own page…
  settings ux web · e62ea469
• RADD-1094 import_jira.py uploads attachments to a route RADD-895 deleted
  , with the evidence. server/scripts/import_jira.py:386 POSTs /items/{item_id}/attachments — the pre-spec-102 alias route that RADD-895 (00182d7) deleted. grep 'items/{item_id}/attachments' server/src/ → zero hits; the only live route is POST /attachments, which requires entity_type/entity_id form fields…
  attachments bug import · 6779f1ab
• RADD-1097 Rename-residue purge: ~40 dead enum members, constants, kernel fields and frontend exports
  the ghost-hunt workflow (10 agents, adversarially verified, HEAD c670f0c) confirmed a large residue class — symbols left behind by renames/refactors, every one independently re-verified as having zero readers:
  cleanup kernel web · ca1793f9
• RADD-687 Board/view pagination beyond 200
  Views cap at 200 items; larger result sets truncate silently on boards (lists got Load more in spec 41). With Jira-scale data (500k+ items in the perf seed) a board over a broad SLQ needs column-windowed loading.
  views web · c670f0c1
• RADD-1090 Merge duplicate issues
  the AI surfaces duplicates (similar-issues fusion, KB deflection) but no operation acts on the finding — half a feature in an AI-native pitch.
  ai items · 8da6397c
• RADD-1089 Convert item kind: epic ↔ issue ↔ subtask
  kind is create-only; over-decomposition (two "issues" that were one component) or under-decomposition (a subtask that grew into real work) is unfixable without recreation.
  items · 15bf472c
• RADD-1088 Clone an issue
  no duplicate/clone operation exists anywhere in the codebase — the audit calls it the most-used bulk shortcut in practice.
  items · c30dc6ac
• RADD-1092 Every first-party manifest declares its license, so the SBOMs stop reporting our own plugins as unlicensed
  the per-release CycloneDX documents listed our own packages as unlicensed — the image SBOM catalogs the module UI remotes' package.jsons (approvals, csat, mailintake, milestones, participants had no license field), and the web SBOM reads package-lock.json, which had never been refreshed after…
  release · 65e41cf5
• RADD-1083 Fresh-initial-commit publish procedure
  files that must not be public have been tracked since ~July, so deleting them today does not remove them from clones of this repository's history.
  docs release · 74c85fdc
• RADD-1087 Move an issue between projects
  update_item never writes project_id; a mis-filed issue can only be recreated by hand and deleted, losing comments, history and worklogs.
  items · 911b9016
• RADD-1086 Encrypt webhook endpoint secrets at rest
  webhook endpoint signing secrets are stored plaintext in the database; modules.md's own note says "encrypt when the secrets layer lands." A DB dump or SQL injection hands an attacker the ability to forge signed deliveries to every consumer.
  security webhooks · f05c438a
• RADD-1085 item. and comment. payloads bypass field grants; READ blanking missing on reports, FTS, MCP**
  (documented in modules.md as "trusted consumer" shortcuts, unacceptable once instances have untrusted members): item.* event payloads — and therefore webhook deliveries — carry the full custom_fields map regardless of field grants; comment.* payloads carry the excerpt even for internal comments; builtin-field…
  auth security · e44ce52e
• RADD-1080 README rewrite for the public launch
  the README is the launch's front door and it is stale ("every pillar (specs 01–48)" while 119 specs have shipped), has no license section, no screenshots, no demo link — and its quick-start instructs the public to import files labeled internal-only.
  docs release · 6bc77bf6
• RADD-1083 Fresh-initial-commit publish procedure
  files that must not be public have been tracked since ~July, so deleting them today does not remove them from clones of this repository's history.
  docs release · 5ad5397a
• RADD-1081 Community files: contribution licensing, code of conduct, templates, in-repo changelog
  docs/contributing.md is substantively good but operator-bound (private Forgejo sign-in, mandatory filing on the owner's tracker) and silent on what license contributions arrive under — which matters for an AGPL project. No CODE_OF_CONDUCT.md, no issue/PR templates, no in-repo CHANGELOG (it generates into the wiki…
  docs release · 052d0489
• RADD-1082 Demo scripts POST the removed /workspaces endpoint
  scripts/demo*.sh (the feature walkthroughs README/CLAUDE.md point at) still POST /workspaces, an endpoint removed when workspace scope was dropped in the spec 61–67 wave. Every demo script 404s on a fresh checkout — first-contact scripts that fail are worse than none.
  bug release · af6224ad
• RADD-1079 Operator docs: TLS for compose, upgrade procedure, sizing, single-instance limits
  deploy.md's compose track — the most likely first self-hoster path — ends at http://localhost:8000 with no reverse-proxy/TLS section, no upgrade procedure (Helm has one; compose has nothing: no migration statement, no backup-first rule, no version-skip policy), no resource floor anywhere, and the single-replica…
  docs release · 8d44ae6e
• RADD-1078 SECURITY.md and first-run hardening defaults
  an auth-heavy product (local+TOTP, LDAP, SSO, webhooks, encrypted backups) has no private vulnerability-disclosure channel — and the issue tracker is public. Nothing tells a first-run operator to set RADD_SESSION_COOKIE_SECURE, restrict RADD_TRUSTED_PROXIES, or that RADD_MCP_ENABLED defaults to true.…
  docs security · 104b6e38
• RADD-1077 Ship the license: AGPL-3.0 root text, package metadata, third-party notices
  README line 3 promises "AGPL, never open-core," but the only license file in the repo is sdk/LICENSE (Apache-2.0) — a scanner or careful human concludes the whole project is Apache-2.0, which surrenders the copyleft the pledge depends on. server/pyproject.toml and both web package.jsons declare no license;…
  release · 6fffce19
• RADD-1076 Scrub internal provenance from docs, scripts and UI placeholders
  the repo carries traces of the environment it was built in: an origin-company name in 26 files (docs/specs, PLAN.md incident write-ups naming real people at ~945–954, research notes, code comments, a migration comment), a competitor-tracker name in 5, internal hostnames as executable defaults (seed_dev_stack.py:56…
  docs release · 7aa5ac89
• RADD-689 Replace real-content sample data with synthetic
  server/scripts/sample_data/ holds real internal Jira content and must not ship in a public repo. Replace with generated synthetic data of the same shape (the perfseed generator is most of the answer).
  import · 3d093f4a
• RADD-1075 Remove a stale reconciliation artifact from server/scripts
  a timestamped one-shot ops artifact (server/scripts/reconcile_ad_users_20260723T213102Z.json, 166 KB, the 4th-largest tracked file) was committed in July and has no runtime consumer. Operational dumps of this kind must never live in the tree — that's what gitignored var/ is for.
  release · 6c5f54c0

Changes from v0.33.0 to v0.34.0.

Pages

• SBOM 0.34.0

---

Mirrored from project.radd-hq.com on 2026-09-12. Documentation is written there; this copy is regenerated by scripts/publish_wiki.py and hand edits do not survive it.