Release v0.4.0 — Vector search, dynamic domain packs, webhook notifications · decisionbox-io/decisionbox-platform

Highlights

Vector search stack — Semantic search and RAG-powered Ask Insights built on Qdrant, with 6 embedding providers and a full dashboard experience (Search page, Ask Insights chat, Spotlight search).
Dynamic domain packs — Domain packs are now stored in MongoDB and editable from the dashboard. No more code changes to add, edit, or distribute a pack.
Webhook notifications — Slack, generic HTTP, and email webhooks when discoveries complete.
Security hardening — 18 Dependabot alerts resolved (1 critical, 2 high, 15 medium) across grpc, go-jose, oauth2, and AWS SDK v2. Dashboard Docker image now runs apk upgrade on build.
Critical infra fixes — IP allowlist is now actually wired to the ALB / GCE ingress (previously Terraform created the SG/policy but Helm never saw them), and Terraform LLM IAM is now granted to the API role so /ask works on EKS/GKE deployments.

6 embedding providers: OpenAI, Vertex AI, Bedrock, Azure OpenAI, Voyage AI, Ollama
Qdrant vector store provider (gRPC, HNSW search, collection management)
Agent Phase 9: embed & index pipeline (insights + recommendations)
POST /search semantic search with filters + cross-project search
POST /ask RAG-powered Q&A with multi-turn sessions and citations
Dashboard: Search page, Ask Insights chat, Spotlight (Cmd+K), recommendation detail page, embedding-settings tab
Infrastructure: Qdrant Helm subchart, setup wizard Step 6, qdrant service in docker-compose

Packs stored in MongoDB, no compiled Go required
CRUD at /api/v1/domain-packs, portable JSON import/export
Dashboard Domain Packs management page with markdown prompt editor
Built-in packs (gaming, ecommerce, social) seeded from embedded JSON on first startup
DOMAIN_PACK_PATH env var removed; agent no longer depends on domain pack code

Webhook notifications (Slack, generic HTTP, email) on discovery completion, configurable per-project with templated payloads

Anonymous usage telemetry (opt-out via TELEMETRY_ENABLED=false or DO_NOT_TRACK=1). No PII, no queries, no credentials. See TELEMETRY.md.

Dashboard chart gains extraEnv / extraEnvFrom (parity with API chart) — chart bumped 0.1.0 → 0.1.1
IP allowlist now actually attached on AWS (inbound-cidrs annotation) and GCP (BackendConfig + Cloud Armor)
Orphaned AWS ip_allowlist security group removed
Terraform enable_bedrock_iam / enable_vertex_ai_iam now also attach to the API's IRSA / Workload Identity SA

K8s test connection no longer returns "Unknown error" — extractJSONObject now scans pod logs from the end and skips structured log lines. RBAC Role gains pods/log.
Redshift SQL fix prompt is now Redshift-specific (previously empty) — covers PostgreSQL features Redshift lacks (DISTINCT ON, FILTER, LATERAL, generate_series, string_agg, regexp_matches, FORMAT) and native alternatives (QUALIFY, LISTAGG, SUPER + json_extract_path_text, DATEADD/DATEDIFF, CONVERT_TIMEZONE).
apiserver.Run() now owns subcommand routing (e.g., backfill-embeddings) so custom API binaries get them for free.

Vector search is opt-in. If you don't configure Qdrant and an embedding provider, the new /search and /ask endpoints will return errors but nothing else changes.
DOMAIN_PACK_PATH is gone. If you set this env var, remove it. Domain packs are now seeded from embedded JSON into MongoDB and managed via the dashboard.
Dashboard Helm chart is now 0.1.1. Upgrade with helm repo update && helm upgrade decisionbox-dashboard decisionbox/decisionbox-dashboard.
Terraform LLM IAM: if you had enable_bedrock_iam = true or enable_vertex_ai_iam = true set on GCP/AWS, re-running terraform apply will attach the IAM policy to the API role as well. No action required beyond apply.
AWS IP allowlist: if you've been using allowed_ip_ranges, setup.sh --resume will switch the dashboard ingress to the inbound-cidrs annotation. The orphaned aws_security_group.ip_allowlist will be destroyed on the next apply.
Anonymous telemetry is on by default. To disable, set TELEMETRY_ENABLED=false or DO_NOT_TRACK=1 in your API deployment.