Skip to content

Claros v0.4.1

Choose a tag to compare

View all tags
@umutgokbayrak umutgokbayrak released this 28 Jul 12:33
· 6 commits to main since this release
v0.4.1
e5445da

v0.4.1 - Operational visibility

This release adds the ability to see what the running container actually has,
rather than what the repository says it should have.

Added

  • GET /version (public, no database access): commit SHA, edition, build time.
    The SHA is injected at image build time.
  • GET /v1/diagnostics (authenticated): for each encryption key, whether it is
    present, its byte length, and a fingerprint. Key values are never returned.
  • claros doctor: compares local HEAD against the deployed commit, reports the
    database target and migration state, transport config counts and webhook
    secret fingerprint, and whether the local and container keys agree.
    Read only, it changes nothing.
  • The deploy pipeline now polls /version after deploying and fails the job if
    the deployed commit does not match the pushed commit. A missing secret no
    longer produces a green job with skipped deploy steps.

Why this exists
A webhook and unsubscribe outage took a day to diagnose. The signature
verification code was correct throughout. The container was running a stale
encryption key because a secret had been rotated without restarting the
container, so stored transport configs could not be decrypted. Nothing in the
system could show that. Rotating a secret has no effect until the container
restarts, and a green deploy can keep serving the previous image for several
minutes.

Not working or not included

  • Dashboard: there is no UI. Phase 5 has only just started.
  • Cloud edition: brain-cloud is a stub and the container refuses to start with
    CLAROS_EDITION=cloud. Self-host community edition is the only working mode.
  • Unsubscribe: the link resolves and the page renders, but suppression on click
    and skipping of that address on later sends are not verified end to end.
  • Transports: Resend only. SES and SMTP adapters are not implemented.
  • No per-tenant circuit breaker and no daily send cap.
  • Knowledge base auto-crawl is not implemented.
  • There is no written end to end smoke test yet.

Known sharp edge
transport set replaces the config instead of merging it. If webhook_secret is
omitted it is silently dropped, and every subsequent webhook returns 400 with
no logged reason.

Assets 2
Loading