v2.0.0 — Explicit selection replaces weighted actions

Retire public weighted recommendations, prefill, legacy project creation and legacy model/task/baseline re-picks with authenticated HTTP 410. Mixed PATCH requests fail without partial writes. Existing projects, names/preferences, Jenkins metadata, CI tokens, old agent configuration/ingestion, findings/feedback and history remain supported; new selections use the exact source-backed /execution/v1 contract.

Dormant chat text now labels legacy estimates and feedback honestly. Explicit projects return an offline answer without entering legacy grounding or adding an old opener; persisted conversations remain unchanged. Update API, agent and accounting documentation without changing agent code or enabling any runtime.

Version 1.15.0 → 2.0.0 (major): supported creation/re-pick API behavior is retired. Coordinate frontend 2.0.0; existing agents continue reporting during the upgrade window. No B17 migration: head remains b16c0a7a0001. Agents remain 1.8.0. Rollback retains additive schema/history. B8–B12 live support, reviewed canonical mappings/rates, production imports/migrations and deployment remain separately gated; B16 schedules stay disabled and outside watched Applications.

Validation: TDD retirement failures first; final complete fake backend/agent suite on disposable PostgreSQL 16 1,219 passed, 40 preserved opt-in skips, existing Starlette warning only (592.87s). Includes populated upgrades, old-agent/token/ingestion compatibility, immutable selections/billing, exact evidence, tenancy, imports/refresh and chat. Focused retirement/chat/prefill: 68 passed, 3 opt-in skips. Compileall, Bandit high/high, wheel/sdist build and self-review passed. A required real local-backend browser smoke verifies anonymous catalog, retirement and empty runtime eligibility. No paid/live provider calls or operational changes.

Historical test setup now uses an isolated test-only wrapper over internal services; public retirement tests always use the real application routes. Those helpers are not shipped or mounted on the production app.

Publication verified: workflow 35988502079 succeeded. Anonymous Linux amd64 pull passed; OCI version 2.0.0 and revision 3186c64763eea5a0a24d6c0b9ecada9657419b7d match reviewed main. Image digest: sha256:ff4c915aa636dd747525fd2ea18df81243417d560cb8fd865e1df6d22a73061a. Publication does not deploy the image.

v1.15.0 — Catalog refresh and operator readiness

Adds a bounded per-source refresh CLI that reuses B3/B4 acquisition and atomic promotion. Structured changes can promote automatically; fetched reports remain separate immutable bytes until a human reviews the exact hash against an accepted snapshot. Failed/unchanged feeds keep last-good evidence, and lock contention skips without fetching or advancing freshness.

Operators can reverse the active snapshot with a source-bound immutable audit. Opt-in /metrics reads durable check state in one bounded query and distinguishes missed successful checks, failures, pending review, snapshot age and publication age. Refresh state is separate from local manifest imports so those cannot mask upstream failures. Defaults do not start a scheduler or enable metrics.

Migration b16c0a7a0001 follows a0b1c2d3e4f5, preserves populated catalog data, validates exact report bytes and protects operator history. Populated downgrade refuses before DDL. Existing import CLI behavior, catalog/runtime independence, unresolved aliases and agent contracts remain compatible.

Validation: Full final fake backend/agent suite on PostgreSQL 16: 1,216 passed, 40 opt-in skips, with the existing Starlette test-client deprecation warning. Final importer/refresh suite: 188 passed. Wheel build and importer/B3/B4 packaging checks, focused Bandit, static checks and self-review passed. No production imports/migrations, paid calls, runtime/rate activation or deployment. The companion GitOps chart is disabled/suspended and outside watched Applications.

Release: 1.14.0 -> 1.15.0 (MINOR) for compatible new operator and monitoring functionality. No agent release is needed: agent execution/config/result contracts are unchanged. Publish the reviewed main commit and verify anonymous GHCR pull/OCI labels; publishing does not change deployment pins.

v1.14.0 — Immutable selected-run usage and cost

CI runs now retain selected-model estimates from the exact executed revision and a dated, immutable rate snapshot. The new owner-scoped /projects/{id}/usage/v1 read separates complete estimates, partial known charges, unavailable coverage and legacy stored amounts; project edits and feedback never reprice historical runs. Native accounting preserves cache/reasoning semantics and effective returned model/tier, while normalized OpenCode usage remains explicitly incomplete.

Adds migration a0b1c2d3e4f5 with append-only rates and protected run attribution. No prices or runtime activation are seeded. Native agents emit optional model/tier fields only when configurations advertise B15 support, preserving older payloads. Existing costs and savings endpoints remain compatible. Actual migration, rates and deployment require separate operational approval.

Validation: full fake PostgreSQL 16 suite 1,198 passed / 40 opt-in skipped; after final telemetry/attribution refinements, all agent tests and affected billing/API/migration suites 514 passed / 29 opt-in skipped. Wheel build and diff checks pass. Existing Starlette deprecation warning remains. No paid/live model calls.

Releases: backend 1.13.0 -> 1.14.0 MINOR for additive owner usage API and immutable billing functionality. Agents 1.7.0 -> 1.8.0 MINOR (both shared-sequence images) for compatible negotiated response telemetry; request profiles, limits and gate behavior are unchanged. Fresh tags, Releases and GHCR versions checked. Publication is separate from deployment.

Publication verified September 24, 2026: successful release workflow; empty-config anonymous GHCR pulls and matching OCI version/revision labels.

• ghcr.io/steve-droid/driftplain-backend@sha256:8098e3ee1bde4f4f8313e743c05a1bbde02a0020f169c5fddb7dcd66948f862b
• ghcr.io/steve-droid/driftplain-agent@sha256:dc9d85cdc7ee7a7fe551e4714e1d62c9e75b1ab508e801a75a216820cc26c06c
• ghcr.io/steve-droid/driftplain-agent-security@sha256:95033f3166f688a9fad51dca6932b6f6dc6fa58136a5e9e862f374ac8700c53d

Review-agent first push hit GHCR unknown blob; the tag was confirmed absent and only the failed matrix job was rerun successfully. Existing artifacts were not overwritten.

v1.13.0 — Other Jenkins setup

Other CI setup now returns an additive Jenkins stage that captures single-call JSON or OpenCode result/patch artifacts and archives them even after failure. The stage preserves the failing command exit and never inserts prompt text or validation argv into shell code. Existing launcher commands remain available.

Single-call Docker commands now apply the saved CPU, memory and process limits. Owner scoping, exact enabled-runtime checks and operator image-digest requirements remain unchanged. No migration, executor change, pending-runtime activation or deployment.

Validation: 60 initial PostgreSQL/API selection/configuration checks; full backend fake suite 1,172 passed / 40 opt-in skips; final focused Other setup/API suite 10 passed, including newly added wrong-mode/disabled-runtime rejection. Five real network-disabled container boundary checks and all three pinned OpenCode profile/MCP/tool checks passed without generation. Wheel build and diff checks passed. Shell tests execute a failing fragment to confirm artifact capture and exit preservation.

Release: backend 1.12.0 -> 1.13.0 (MINOR), compatible additional Other Jenkins setup output plus resource enforcement. Agents remain 1.7.0; no consumer implementation changed. Existing tags and deployment pins remain untouched.

Publication verified: workflow 35975823763 succeeded. Anonymous GHCR pull matched version 1.13.0 and main revision 7a1307c; digest sha256:514780ee6c71445948b80e62b6d0c8e09b364d5ffc635e3ff96946dfe8dce738. The published setup module imported and generated the custom stage offline.

v1.12.0 — Exact candidate search and named CI setup

Named review/security projects could be selected through the explicit API but could not obtain a compatible CI setup command. Extend the owner-scoped versioned seam with digest-pinned, task-specific review/scanner commands and failure-preserving Jenkins stages. Add exact canonical-model and evidence filters for Explorer transitions without changing ranking or catalog/runtime independence.

Historical pre-B7 configurations require a new revision. Pending profiles remain blocked; no runtime activation, migrations, agent consumer changes or deployment.

Validation: full fake PostgreSQL suite 1,166 passed / 40 opt-in skips; final selection/setup checks 40 passed after historical-config hardening. Shell syntax, Ruff F/E9, compilation and wheel build passed. The published security image passed the generated cgroup/read-only boundary offline with network disabled.

Release: backend 1.11.0 → 1.12.0 MINOR, additive compatible query parameters and setup support. Agents remain 1.7.0: no changed agent consumer requires an artifact. Publication is separate from deployment.

Published image verified anonymously: ghcr.io/steve-droid/driftplain-backend:1.12.0 at sha256:b819a57bf3854b0eaa5f8f2c42d81602c74b3776fd06d134ffbdb8538829da45. OCI revision/version match reviewed main. Release workflow 35973039404 succeeded.

v1.11.0 — Durable failure claims and diagnosis evidence

Backend 1.10.0 → 1.11.0 (MINOR): additive diagnosis configuration, durable pre-invocation claims, bounded redacted evidence and failure-only Jenkins setup. Existing supported APIs and historical task envelopes remain compatible.

Upstream CI failure remains distinct from agent outcome. Project/build/stage deduplication commits before any model invocation, with no lease or automatic takeover. Results bind the exact execution revision, failure context and retained log evidence. Owner scoping remains enforced.

Migration f9a0b1c2d3e4 adds the immutable claim table after e8f9a0b1c2d3; populated history blocks downgrade. No production migration or deployment was performed. All six diagnosis model/profile integrations remain pending exact live verification.

Verified in PR #46: full fake PostgreSQL suite 1,157 passed / 40 skipped; complete agent suite 290 passed, final diagnosis regressions 39 passed, final API regressions 7 passed; 29 offline container checks and six pinned OpenCode profiles; migration, static, packaging and generated-shell checks. No paid calls.

Published linux/amd64 images (anonymous pull and OCI revision/version verified):

• ghcr.io/steve-droid/driftplain-backend:1.11.0: sha256:c8aed98d26c301b4c0b52ab5e3eaa04cc79346df4fa8a8f71a8121c92834321c

v1.10.0 — Named test evidence and Jenkins setup

Backend 1.9.0 -> 1.10.0 MINOR: additive named-test environment, immutable execution evidence and owner-scoped Jenkins setup contracts. Existing supported review/security/Other workflows remain compatible. PR #45; reviewed main commit ad8c76f.

Named-test validation binds generated paths, positive discovery/execution, preserved existing-suite identities, dependency lock, final patch, command and executed revision. Runner usage applies without invented billing. No migration or seeded runtime. All six exact test profiles remain pending live verification. Publication does not deploy or enable support.

Verified: full fake PostgreSQL suite 1,114 passed / 38 skipped; final agent suite 252 passed / 28 opt-in skips; focused plus explicit container checks 51 passed. Static, wheel and actual launcher package checks passed; six pinned offline profiles passed without generation.

Published images verified by empty-config anonymous pull, matching OCI revision/version and network-disabled package checks:

• ghcr.io/steve-droid/driftplain-backend@sha256:8b95adf392b2e98471dadd9ad5eb2c27b32c2a1d2290adb840fdcc5387c8c44c

v1.9.0 — Other execution usage and setup

Backend 1.8.0 -> 1.9.0 (MINOR): additive Other native/runner usage attribution and owner-scoped runtime setup command API. Existing payloads, immutable history and legacy paths remain compatible; no schema migration.

B10 custom execution uses literal bounded prompts, exact disposable Git patches and separate credential-free validation. Three exact models remain pending in each mode. No runtime activation or deployment.

Verified: 1,090 passed / 16 skipped full fake PostgreSQL suite; 257 passed / 5 skipped complete agent and affected API tests; five explicit real-container checks; pinned OpenCode config/model/tool/MCP/literal-macro checks; static checks, wheel and image/package smoke. See PR #44 and agent/OTHER-SUPPORT.md for boundaries and limitations.

Published and anonymously pulled; OCI revision/version verified:

• ghcr.io/steve-droid/driftplain-backend:1.9.0 — sha256:920b89f60d1652be48396177877d77fe4ee2a8040d3d243196e42baf4b8fbac6

agent-v1.8.0 — Negotiated native billing telemetry

CI runs now retain selected-model estimates from the exact executed revision and a dated, immutable rate snapshot. The new owner-scoped /projects/{id}/usage/v1 read separates complete estimates, partial known charges, unavailable coverage and legacy stored amounts; project edits and feedback never reprice historical runs. Native accounting preserves cache/reasoning semantics and effective returned model/tier, while normalized OpenCode usage remains explicitly incomplete.

Adds migration a0b1c2d3e4f5 with append-only rates and protected run attribution. No prices or runtime activation are seeded. Native agents emit optional model/tier fields only when configurations advertise B15 support, preserving older payloads. Existing costs and savings endpoints remain compatible. Actual migration, rates and deployment require separate operational approval.

Validation: full fake PostgreSQL 16 suite 1,198 passed / 40 opt-in skipped; after final telemetry/attribution refinements, all agent tests and affected billing/API/migration suites 514 passed / 29 opt-in skipped. Wheel build and diff checks pass. Existing Starlette deprecation warning remains. No paid/live model calls.

Releases: backend 1.13.0 -> 1.14.0 MINOR for additive owner usage API and immutable billing functionality. Agents 1.7.0 -> 1.8.0 MINOR (both shared-sequence images) for compatible negotiated response telemetry; request profiles, limits and gate behavior are unchanged. Fresh tags, Releases and GHCR versions checked. Publication is separate from deployment.

Publication verified September 24, 2026: successful release workflow; empty-config anonymous GHCR pulls and matching OCI version/revision labels.

• ghcr.io/steve-droid/driftplain-backend@sha256:8098e3ee1bde4f4f8313e743c05a1bbde02a0020f169c5fddb7dcd66948f862b
• ghcr.io/steve-droid/driftplain-agent@sha256:dc9d85cdc7ee7a7fe551e4714e1d62c9e75b1ab508e801a75a216820cc26c06c
• ghcr.io/steve-droid/driftplain-agent-security@sha256:95033f3166f688a9fad51dca6932b6f6dc6fa58136a5e9e862f374ac8700c53d

Review-agent first push hit GHCR unknown blob; the tag was confirmed absent and only the failed matrix job was rerun successfully. Existing artifacts were not overwritten.

agent-v1.7.0 — Failure diagnosis and isolated repair proposals

Shared agents 1.6.0 → 1.7.0 (MINOR): opt-in failure diagnosis and optional isolated repair consumers; both agent images share this version. Existing supported workflows, CLI contracts and historical task results remain compatible.

Diagnosis uses only a configured failed upstream stage, bounded redacted logs and exact-commit source. The launcher claims the failure durably before the model call. Read-only analysis has a read-only selected-source mount and no validation tool. Optional fixes reuse the isolated editor/credential-free validator, protect tests and quality gates, and never make the original CI build pass. No automatic commits, pushes, PRs or deployment of model changes.

GPT-5.6 Sol, Claude Sonnet 5 and Gemini 3.7 Flash each have separate read-only/fix profiles; all six remain pending exact live verification. OpenCode stays pinned to 1.18.20. API delivery failure survives as a separate local error; uncertain claims are not retried. See agent/DIAGNOSIS-SUPPORT.md for narrow v1 repair paths and operator setup.

Verified in PR #46: full fake PostgreSQL suite 1,157 passed / 40 skipped; complete agent suite 290 passed, final diagnosis regressions 39 passed; 29 real offline container checks, six network-disabled pinned profile checks and actual launcher package/Git/Docker CLI smoke checks. No paid calls, runtime activation or deployment.

Published linux/amd64 images (anonymous pull and OCI revision/version verified):

• ghcr.io/steve-droid/driftplain-agent:1.7.0: sha256:90e10d31022e8f214d6a61d8d389b770307ba9db20d5e9876cd5c6cc82f6ef46
• ghcr.io/steve-droid/driftplain-agent-security:1.7.0: sha256:0eee9e8142befd7dcbbe447fe4f09d5c01d1aa9d1a1fffe9d28986e210ad8e3e