Open Shadow AI v0.3.0 — Hardened delivery preview

v0.3.0 — Hardened delivery preview

2026-10-07 · Prerelease for controlled pilots

This preview strengthens delivery, recovery and evidence handling since the v0.2.0 SSO/SCIM preview. Release source 49a58d7 contains PR #10 hardening, PR #12 preparation and roadmap documentation; roadmap capabilities remain planned. Server and console components are 0.3.0; the independently versioned standalone agent remains 0.1.0.

Validation: release source 49a58d7 passed CI run 37690314834: all 50 jobs succeeded (32 unsigned gates, 18 signing jobs), together in attempt 1.

Changes since v0.2.0:

• Endpoint, network and syslog collectors gain bounded persistent delivery queues, scoped credentials, restart recovery and explicit dead-letter replay. Redis admission and retention separate pending work from retained originals; pipeline status preserves unknown capture loss.
• Passive DNS/TLS/QUIC/HTTP metadata imports and the Network view expose naming evidence alongside endpoint inventory and instrumented events. Catalog attribution is more deterministic, and transient URL-path/user-agent matching discards those raw signals after ingestion.
• Existing optional SSO/SCIM gains bounded login admission, refusal under Redis pressure, persistent HttpOnly console sessions, CSRF-protected writes and server-side sign-out. Identity membership now ages independently; pseudonymization and historical cleanup have explicit boundaries.
• Per-process startup, liveness and readiness probes distinguish a running worker from dependency or processing progress. The Kubernetes profile uses external stores and explicit deployment controls; deployment still requires target acceptance.
• Hash-locked Python dependencies, pinned build inputs and maintained service recipes support repeatable builds. Signing-job archive revalidation now installs the locked build toolchain first. Native amd64/arm64 OCI, SBOM/provenance and strict advisory coverage gates bind evidence to its source and image; they do not promise identical output bytes or a vulnerability-free runtime.
• The isolated qualification lab rehearses pending-work recovery, Redis pressure and cold backup/restore with inventory comparisons and fresh post-restore writes. Its owned exporter is built before physical measurements, then started without build or pull during the experiment.

For upgrades, follow the update procedure against a restored copy. Back up data, configuration and keys; stop application writers, optional collectors and remote producers. Start only stores, apply ClickHouse 002, then PostgreSQL migrations through 004/005 before application startup. 005 clears historical identity arrays/counts whose age cannot be proved, and resets primary evidence plus stored sample/observation excerpts in detection summaries; detection records remain. Start new workers to initialize actual Redis groups, reconcile indexed retention with legacy writers stopped, then wait for readiness and enable collectors. Review queue retention.

The unfixed node-exporter GO-2026-5932 finding remains visible with UNKNOWN severity and requires an operational decision. Review delivery gates and qualification boundaries.

One organization per deployment. Passive observations cannot establish prompt/content access, model choice, token totals or bills; supplied instrumentation retains its own limits. Synthetic/lab results establish neither universal detection accuracy, production certification nor HA. Real IdP sign-in/MFA, AD, Kubernetes, capacity and deployment-specific RPO/RTO still require acceptance. CI signatures authenticate OCI archives and scanner evidence manifests; generated GitHub source archives are outside that coverage. This source preview has no bundled binary assets.