v0.1.0-rc3

The third release candidate. A security fix reported against rc2, the fix that lets the connectors added in rc2 actually be created, and everything else that landed since. latest still does not point here.

ghcr.io/deeplethe/utopia:0.1.0-rc3

docker-compose.yml defaults to this tag, so the quick start in the README works unchanged.

Security

Source credentials stay on the server. Until now only the custom fetcher's auth_header was stripped from responses; the S3 / Azure / GCS keys, the WebDAV password and the Notion token went out to every viewer of a knowledge base, on listing as well as on create and update. One list of credential keys now governs the listing, the responses, the update merge (an empty field keeps the stored value) and the audit log. Every source endpoint also confirms the source belongs to the knowledge base in the path. Reported by @hekr4jivs (#246). Vulnerability reports go to security@deeplethe.com, see SECURITY.md.

Sources

S3, Azure Blob, Google Cloud Storage, WebDAV and Notion sources can be created — rc2 shipped them in the UI and the sync engine but not in the creation allowlist (#247, also @hekr4jivs). The kinds now come from one enum that the allowlist, the sync dispatcher and the UI list all derive from, with a test that keeps them aligned.

Reasoning

A derivation that contradicts an assertion is no longer silently dropped: it appears under Review > Axioms with the derived triple, the assertion it hit, one clue (the assertion has no end date, two entities share the name, low extraction confidence) and the repairs — give the assertion an end date, retract it, see duplicates, open the ontology, or let both stand. Two rules that produce contradicting derivations are reported once per rule pair under Ontology. On the graph a contested assertion is drawn in an alert colour and a blocked derivation as a ghost edge; the entity panel marks disputed facts and lists the derivations that did not land, each with its proof chain. A derivation's proof chain reads down to the sentence it came from.

Resolution

A declared owl:disjointWith keeps same-name entities apart ahead of class kinship and the built-in confusable list; disjointness is inherited, so a declaration on a parent class reaches its children.

Ask the data

Trino (Iceberg / Delta / Hive), Databricks and Snowflake are query engines behind the same trait; the connection string's scheme picks the engine.

Also

The decision records under docs/decisions are condensed into English.