AiSOC v20.3.0 — the community-contributions release

[beenuar]

AiSOC v20.3.0 is out: https://github.com/beenuar/AiSOC/releases/tag/v20.3.0

This is the community-contributions release — six externally contributed fixes and one externally contributed feature merged in one pass, the console's front door fixed, and the detection corpus made more honest again.

Highlights

• The console's root URL now lands you on your console. A clean self-hosted install's / rendered the project's marketing page — neither the dashboard nor the login page an operator expects (thanks to rmsferreira for reporting it). / now redirects to /login, which routes onward by itself: a first run lands on the setup wizard, a signed-in session on the dashboard. A deployment that genuinely is a public site opts back in with the runtime AISOC_MARKETING_HOME.
• Pick your model from a list instead of typing its id. For the custom provider — any OpenAI-compatible endpoint — POST /api/v1/llm/credentials/models asks the endpoint what chat models it serves and offers them in the BYOK selector. Externally contributed, vendor-neutral by design, bounded and SSRF/air-gap-guarded, and the stored key is only ever sent to the stored base URL.
• GitHub detection rules fire on real events now. An external report that only 1 of 12 GitHub rules fired on real connector output was substantially correct: five rules were re-claused to GitHub's documented audit vocabulary (deploy keys log as public_key.create — the action the old rule matched does not exist), five were quarantined with recorded reasons, and a CI gate now replays every GitHub rule through the real connector so the class cannot drift back. The executable count honestly moves 2,535 → 2,530 — downward, because rules that could not fire stopped being counted.
• Five community fixes from alexmateescu: deterministic LLM-gateway 400s now dead-letter instead of retry-storming, prompt bytes are capped at the egress chokepoint, a saved connector no longer 422s every test-connection once it has polled, fresh chatops deploys no longer crash-loop on a missing mount, and triage verdicts are no longer clipped mid-JSON at 512 output tokens.
• Three dependency advisories cleared (@hono/node-server 2.1.5, decode-uri-component 0.5.1, archived-SDK zod 4.6.6), and the Dependabot queue stands at zero.

By the numbers

10 defects fixed in this release, 22 across it and the two before (10 here, 1 in v20.2.1, 11 in v20.2.0 — distinct product or CI defects named in Fixed/Security sections, dependency advisories excluded). No breaking changes. The chart publishes as 7.12.0; neither stable channel moves (chart 7.8.0, images v19.0.0, by deliberate decision — both verified by digest after publish).

Full details in CHANGELOG.md and RELEASES.md. Thanks to everyone who filed reports and sent patches — every one of the external contributions above was verified against a real stack before merging, which is exactly how we want this to keep working.