Open Shadow AI v0.3.0 — Hardened delivery preview

v0.3.0 — Hardened delivery preview

2026-10-07 · Prerelease for controlled pilots

This preview strengthens delivery, recovery and evidence handling since the v0.2.0 SSO/SCIM preview. Release source 49a58d7 contains PR #10 hardening, PR #12 preparation and roadmap documentation; roadmap capabilities remain planned. Server and console components are 0.3.0; the independently versioned standalone agent remains 0.1.0.

Validation: release source 49a58d7 passed CI run 37690314834: all 50 jobs succeeded (32 unsigned gates, 18 signing jobs), together in attempt 1.

Changes since v0.2.0:

• Endpoint, network and syslog collectors gain bounded persistent delivery queues, scoped credentials, restart recovery and explicit dead-letter replay. Redis admission and retention separate pending work from retained originals; pipeline status preserves unknown capture loss.
• Passive DNS/TLS/QUIC/HTTP metadata imports and the Network view expose naming evidence alongside endpoint inventory and instrumented events. Catalog attribution is more deterministic, and transient URL-path/user-agent matching discards those raw signals after ingestion.
• Existing optional SSO/SCIM gains bounded login admission, refusal under Redis pressure, persistent HttpOnly console sessions, CSRF-protected writes and server-side sign-out. Identity membership now ages independently; pseudonymization and historical cleanup have explicit boundaries.
• Per-process startup, liveness and readiness probes distinguish a running worker from dependency or processing progress. The Kubernetes profile uses external stores and explicit deployment controls; deployment still requires target acceptance.
• Hash-locked Python dependencies, pinned build inputs and maintained service recipes support repeatable builds. Signing-job archive revalidation now installs the locked build toolchain first. Native amd64/arm64 OCI, SBOM/provenance and strict advisory coverage gates bind evidence to its source and image; they do not promise identical output bytes or a vulnerability-free runtime.
• The isolated qualification lab rehearses pending-work recovery, Redis pressure and cold backup/restore with inventory comparisons and fresh post-restore writes. Its owned exporter is built before physical measurements, then started without build or pull during the experiment.

For upgrades, follow the update procedure against a restored copy. Back up data, configuration and keys; stop application writers, optional collectors and remote producers. Start only stores, apply ClickHouse 002, then PostgreSQL migrations through 004/005 before application startup. 005 clears historical identity arrays/counts whose age cannot be proved, and resets primary evidence plus stored sample/observation excerpts in detection summaries; detection records remain. Start new workers to initialize actual Redis groups, reconcile indexed retention with legacy writers stopped, then wait for readiness and enable collectors. Review queue retention.

The unfixed node-exporter GO-2026-5932 finding remains visible with UNKNOWN severity and requires an operational decision. Review delivery gates and qualification boundaries.

One organization per deployment. Passive observations cannot establish prompt/content access, model choice, token totals or bills; supplied instrumentation retains its own limits. Synthetic/lab results establish neither universal detection accuracy, production certification nor HA. Real IdP sign-in/MFA, AD, Kubernetes, capacity and deployment-specific RPO/RTO still require acceptance. CI signatures authenticate OCI archives and scanner evidence manifests; generated GitHub source archives are outside that coverage. This source preview has no bundled binary assets.

Open Shadow AI v0.2.0 — SSO & SCIM preview

Open Shadow AI 0.2.0 — console identity preview

Optional console sign-in and provisioning for one organization per deployment:

• OIDC authorization-code sign-in with PKCE S256 and previously provisioned users. The verified issuer and stable identity claim must match SCIM externalId; email never links accounts.
• A documented SCIM 2.0 Users/Groups subset, role mapping by group external ID and session revocation when provisioning changes arrive. Reactivation requires fresh authentication.
• Optional Docker Compose and Kubernetes identity overlays, an Entra setup guide and retained local administrator recovery access. Base deployments keep OIDC/SCIM disabled.
• Bundled proxy logging omits query strings and disables callback error logs to protect authorization codes.

Before upgrading, back up data, configuration and keys; stop application writes and apply PostgreSQL migration 003 before starting the new API/workers. Review username-collision checks and the guarded downgrade in the upgrade procedure. Keep and test a separate local recovery administrator before enabling SSO.

Follow the identity setup guide and supported subset and review the validation evidence and boundaries. Live Entra sign-in/provisioning, other providers and Kubernetes require acceptance testing in your environment. This preview does not include SAML, multi-organization isolation or identity-provider certification.

Validation: all five jobs passed in CI run 36280261065 for source 00e98d6539ac37c7f98d12f3c53d77be8a1f365d: 203 tests per Python version, 32 frontend tests, two real-store integration tests and both HTTP smoke checks. OIDC sign-in uses a signed mock provider; the SCIM smoke uses real disposable stores. This is a prerelease, with live-tenant acceptance still required.

Open Shadow AI v0.1.0 — Public preview

Open Shadow AI v0.1.0 — public preview

Self-hosted AI discovery, with evidence behind every finding. This first Apache-2.0 release is intended for evaluation and controlled pilots, with one organization per deployment.

Included

• An investigation interface with discovery, catalog and governance views, an isolated synthetic demo, a real dashboard screenshot and editable architecture diagrams.
• DNS/proxy parsers, a syslog receiver and endpoint inventory, with explicit distinctions between presence, network observations and instrumented usage.
• An OU-scoped, read-only Active Directory exporter and a Microsoft Entra service-principal inventory collector with optional grant collection. Entra AI matching requires administrator-reviewed application-ID mappings.
• Authenticated canonical-event ingestion in bounded batches for custom collectors, backed by Redis workers, PostgreSQL detections and durable receipts, and ClickHouse events.
• Secret-preserving bootstrap scripts, Docker Compose, a Kubernetes baseline for external stores, and English/French deployment and Microsoft guides.

Validation

All five CI jobs passed for source commit cea2bafab02bfe0298776ab4de679fd4f044acd6: Python 3.12 and 3.13 each passed 72 regression tests with the live integration test skipped, then that integration test passed separately against real PostgreSQL, Redis and ClickHouse. The frontend passed 13 tests and built successfully; PowerShell syntax/dry runs, fresh Docker builds/startup and the authenticated HTTP-to-storage smoke test also passed. See validation scope for reproducible checks and evidence boundaries.

Pilot limits

Live AD/Graph tenants, managed-fleet rollout, Kubernetes clusters and sustained load still require operational validation. Enterprise SSO/SCIM and isolated multi-tenancy are planned. Network or inventory signals do not prove prompt content, model usage or spend; model/token data requires instrumentation and costs remain estimates. This preview claims no production SLA, certification or universal infrastructure coverage.