v0.14.0 - Change Intelligence & Blast-Radius Gateway

v0.14.0 - Change Intelligence & Blast-Radius Gateway

This release adds an opt-in public gateway to the private OpsChugex change-intelligence engine.

Highlights:

• analyze_change_blast_radius for bounded planned-change, topology and readiness evidence
• returns risk level/score, impacted nodes, blast paths, blockers, warnings, evidence gaps and recommendations
• proprietary dependency propagation, risk weighting, blocker rules and readiness scoring remain in the private OpsChugex core
• host-configured HTTPS endpoint and host-side bearer token
• no Terraform apply, Kubernetes mutation, PR merge, deployment execution, approval or rollback action

Verification:

• 116/116 tests passing
• 85.80% statements
• 72.18% branches
• 85.89% functions
• 89.11% lines
• 0 production dependency vulnerabilities

v0.13.0 - Advanced FinOps Intelligence Gateway

v0.13.0 - Advanced FinOps Intelligence Gateway

This release adds an opt-in public gateway to the private OpsChugex advanced FinOps engine.

Highlights:

• analyze_advanced_finops for bounded cloud-cost, utilization and Kubernetes allocation evidence
• returns optimization opportunities, cost anomalies, low/high savings ranges, confidence, correlations and evidence gaps
• proprietary savings factors, anomaly thresholds, prioritization, confidence and deduplication remain in the private OpsChugex core
• host-configured HTTPS endpoint and host-side bearer token
• no resize, termination, commitment purchase, Kubernetes mutation, storage-tier change or billing action

Verification:

• 111/111 tests passing
• 85.76% statements
• 72.10% branches
• 85.71% functions
• 89.12% lines
• 0 production dependency vulnerabilities

v0.12.0 - Cloud Security Posture Intelligence Gateway

v0.12.0 - Cloud Security Posture Intelligence Gateway

This release adds an opt-in public gateway to the private OpsChugex cloud security posture engine.

Highlights:

• assess_cloud_security_posture for bounded asset, identity, secret and network-reachability evidence
• returns security score, risk level, ordered findings, attack paths, evidence gaps and recommendations
• proprietary detection thresholds, severity rules, scoring and attack-path correlation remain in the private OpsChugex core
• host-configured HTTPS endpoint and host-side bearer token
• no credential rotation, IAM mutation, network mutation, encryption mutation or remediation

Verification:

• 106/106 tests passing
• 85.71% statements
• 72.10% branches
• 85.49% functions
• 89.10% lines
• 0 production dependency vulnerabilities

v0.11.0 - Policy & Governance Gateway

v0.11.0 - Policy & Governance Gateway

This release adds an opt-in public MCP gateway to the private OpsChugex Policy & Governance Engine.

Highlights:

• assess_governance_policy for bounded resource evidence
• development, staging, production and regulated profile selection
• owner-attributed, time-bounded exception metadata
• pass / review / block decisions with findings and evidence gaps
• separate governance feature gate for backward compatibility
• host-configured HTTPS endpoint and host-side OpsChugex bearer token
• no policy enforcement or infrastructure mutation

IP boundary:

• private governance profiles remain in OpsChugex/cloud-operations-core
• private control rules remain private
• scoring weights remain private
• exception-evaluation logic remains private
• the public package contains only the MCP contract, validation and guarded transport

Verification:

• 101/101 tests passing
• 85.68% statements
• 72.02% branches
• 85.30% functions
• 89.08% lines
• 0 production dependency vulnerabilities

v0.10.0 - Automated Root-Cause Intelligence Gateway

v0.10.0 - Automated Root-Cause Intelligence

This release introduces an opt-in public gateway to the private OpsChugex root-cause intelligence core.

Highlights:

• diagnose_root_cause across metrics, logs, traces, Kubernetes, cloud, Terraform and CI/CD evidence
• evidence-ranked probable causes with supporting and contradicting evidence
• explicit limitations and recommended next checks
• proprietary scoring and commercial correlation logic remain outside the public MIT repository
• host-configured HTTPS endpoint and host-side bearer token
• no automated remediation or cloud/Kubernetes/Terraform/CI/CD mutation

Verification:

• 95/95 tests passing
• 85.65% statements
• 71.94% branches
• 85.10% functions
• 89.12% lines
• 0 production dependency vulnerabilities

v0.9.0-Distributed-Tracing-and-SLO-Intelligence

What's Changed

• v0.8.1-public-acceptance by @alexcgodwin in #21
• v0.9.0-distributed-tracing-and-SLO-intelligence by @alexcgodwin in #22

Full Changelog: v0.8.1...v0.9.0

v0.8.1-Operations-Intelligence-Completion

What's Changed

• v0.8.1-operations-intelligence-completion by @alexcgodwin in #20

Full Changelog: v0.8.0...v0.8.1

v0.8.0 - Observability and Production Intelligence

Highlightsn- Adds opt-in Prometheus query support with bounded instant and range reads.n- Adds Grafana alert-rule and active-alert summaries.n- Adds allowlisted CloudWatch Logs Insights queries.n- Adds Kubernetes pod-health summaries for approved contexts and namespaces.n- Adds GitHub Actions failure diagnosis with bounded, redacted evidence.n- Adds deterministic cross-signal incident correlation across metrics, logs, alerts, Kubernetes and CI/CD.n- Keeps production observability read-only, allowlisted, bounded and audited.nn## Verificationn- 69 automated tests passed.n- Full coverage gate passed with 71.76% overall branch coverage.n- observability.ts reached 96.93% line coverage and 77.37% branch coverage.`n- Production dependency audit found 0 vulnerabilities.

v0.7.0 - Live Multi-Cloud Observability and Inventory

Adds an opt-in live read plane for AWS, Azure and GCP while preserving credential-free analysis as the default.

Highlights:

• cloud_whoami
• cloud_inventory_summary
• cloud_kubernetes_clusters
• cloud_observability_summary
• cloud_finops_signals
• cloud_drift_compare
• strict AWS account/region/profile, Azure subscription and GCP project allowlists
• AWS STS account verification before AWS resource reads
• bounded normalized provider outputs
• EKS, AKS and GKE discovery
• CloudWatch alarms, Azure metric alerts and GCP logging-sink summaries
• read-only FinOps waste signals
• expected-vs-live drift reporting with no reconciliation path
• no cloud mutation commands
• 57/57 tests passing
• coverage: 84.71% statements, 70.70% branches, 85.75% functions, 88.08% lines
• 0 production dependency vulnerabilities

AWS general inventory uses the Resource Groups Tagging API, so untagged AWS resources may not appear in general inventory or AWS drift comparison.

v0.6.0 - Infrastructure Validation and Runtime Read Layer

Adds safe, opt-in Terraform and Kubernetes operational tooling on top of the v0.5 Controlled Execution Gateway.

Highlights:

• terraform_fmt_check
• terraform_validate
• terraform_plan_summary
• kubectl_current_context
• kubectl_get_resources
• kubectl_rollout_status
• no Terraform apply/destroy
• no Kubernetes mutation or Secrets retrieval by default
• repository/context/namespace/resource allowlists
• bounded summaries instead of raw sensitive payloads
• automatic MCP Registry publication through GitHub Actions OIDC
• pinned and SHA-256 verified MCP Registry publisher
• 49/49 tests passing
• coverage: 83.03% statements, 71.23% branches, 85.42% functions, 86.64% lines
• 0 production dependency vulnerabilities