Release v1.25.0-beta.8

What's Changed

• chore(helm): drop the pre-1.13 StatefulSet migration shim by @Soju06 in #2333
• refactor(bridge): resolve admission and reconnect settings before the prewarm lock by @Soju06 in #2335
• fix(db): retry the startup sentinel seed on SQLite lock contention and name the lock error by @Soju06 in #2339
• perf(bridge): resolve the prewarm snapshot only for eligible payloads by @Soju06 in #2340
• refactor(bridge): keep fail-closed ambiguous-continuation handling and drop the unused recovery modes by @Soju06 in #2336
• feat(settings): manage the bridge operation spool retention from the dashboard by @Soju06 in #2337
• feat(auth)!: add resource-scoped dashboard permission vocabulary by @Soju06 in #2196
• feat(auth): restrict guest-visible sensitive surfaces and make guest sessions revocable by @Soju06 in #2201
• feat(dashboard): hide restricted surfaces from read-only guests by @Soju06 in #2203
• feat(auth): reject cross-site dashboard mutations and start the client least-privilege by @Soju06 in #2204
• feat(auth): add dashboard role rows with code-defined preset grants by @Soju06 in #2217
• feat(auth): add dashboard user tables and migrate the shared admin into a user by @Soju06 in #2218
• feat(auth): make dashboard users the source of truth for login and sessions by @Soju06 in #2223
• feat(audit): record the acting account, target and severity on audit rows by @Soju06 in #2225
• feat(users): add account management, invite links and the roles read API by @Soju06 in #2226
• feat(frontend): tier the login form and header by account facts, add the invite route by @Soju06 in #2237
• feat(frontend): fold the auth cards into one Access card that grows with the team by @Soju06 in #2251
• feat(auth): enable the operator and viewer presets end to end, require TOTP for admin-level accounts by @Soju06 in #2328
• feat(auth): resolve trusted-header identities to accounts through sign-in providers by @Soju06 in #2331
• feat(auth): re-verify a credential before sensitive dashboard changes by @Soju06 in #2334
• feat(auth): map identity-provider groups to roles and add the organisation settings group by @Soju06 in #2358
• fix(overflow): keep a delivered source turn anchored before the first content frame (#2123) by @Soju06 in #2354
• docs(openspec): archive the landed campaign changes and repair one stale delta by @Soju06 in #2359
• feat(dashboard): surface subscription-overflow attribution in the request log and dashboard (#2123 WP-G) by @Soju06 in #2355
• feat(proxy): persist hashed affinity decisions on request logs by @JustYannicc in #2352
• fix(proxy): retire a denied proxy-injected WebSocket anchor instead of re-injecting it by @Abaddollyon in #2248
• fix(images): select compatible host for images and probes by @JustYannicc in #2320
• fix(http-bridge): reuse reservations after owner rejection by @Komzpa in #2353
• fix(proxy): bound aggregate detached retirement lock waits by @JustYannicc in #2315
• test: stub ambient account deletion scheduler by @JustYannicc in #2342
• fix(db): merge the pin-index and affinity alembic heads by @Soju06 in #2368
• fix(balancer): count bare server_error terminals toward overload backoff by @Soju06 in #2360
• fix(proxy): route anonymous output frames to the created response by @mjakl in #2357
• refactor(db): route every SQLite lock check through the shared predicate by @Soju06 in #2361
• refactor(bridge): retire the durable recovery-dispatch storage surface by @Soju06 in #2366
• refactor(config): constantize the token refresh interval by @Soju06 in #2365
• fix(accounts): let the deletion scheduler exit its wait promptly by @Soju06 in #2362
• refactor(db): give the SQLite lock report one owner and state the driver-evidence rule by @Soju06 in #2382
• revert(bridge): restore the recovery-dispatch claim and its fence by @Soju06 in #2383
• fix(proxy): fork model-transition owner conflicts by @Komzpa in #2083
• fix(proxy): narrow the input-image upstream transport pin by @Soju06 in #2386
• fix(proxy): deliver the denied-anchor refusal to native clients by @Soju06 in #2387
• fix(balancer): stop waiting on a hard affinity owner the caller excluded by @Soju06 in #2381
• chore(dashboard): keep the request-log source literals in sync with the backend enum by @Soju06 in #2380
• fix(http-bridge): bound terminal spool writes by @choi138 in #1997
• chore(ci): fail migration authoring when the revision graph forks by @Soju06 in #2379
• feat(auth): gate local password sign-in behind a policy and protect break-glass access by @Soju06 in #2385
• fix(observability): derive sticky_key_source once, from the resolved policy by @Soju06 in #2375
• fix(proxy): anchor unanchored HTTP threads to a stable cache key by @Soju06 in #2367
• feat(dashboard): surface thread identity and cache locality metrics by @Soju06 in #2378
• feat(dashboard): add a cross-account prompt cache isolation probe by @Soju06 in #2372
• ci(openspec): strictly validate changed active folders by @JustYannicc in #2306
• fix(proxy): attribute refused cross-account continuity replays by @Soju06 in #2384
• test(dashboard): make the clean-install overflow statement count deterministic by @Soju06 in #2393
• chore(overflow): discover the request-log source constants in the spec-delta guard by @Soju06 in #2395
• fix(proxy): retire durably unroutable bridge continuity owners by @Soju06 in #2390
• feat(proxy): add shared/isolated thread cache identity modes (default shared) by @Soju06 in #2376
• fix(proxy): retire a continuity owner that cannot return in time by @Soju06 in #2397
• fix(db): converge the forked thread-cache and bridge-retirement Alembic heads by @Soju06 in #2400
• chore: release v1.25.0-beta.8 by @Soju06 in #2341

New Contributors

• @Abaddollyon made their first contribution in #2248
• @mjakl made their first contribution in #2357

Full Changelog: v1.25.0-beta.7...v1.25.0-beta.8

Install / Run

uvx --from "codex-lb==1.25.0b8" codex-lb
docker pull ghcr.io/Soju06/codex-lb:1.25.0-beta.8
helm install codex-lb oci://ghcr.io/soju06/charts/codex-lb --version 1.25.0-beta.8 --devel