v0.7.0 — Slack setup that explains itself, 16MB uploads, plugin UI SDK

146 non-merge commits since v0.6.0 — 73 fix, 26 feat, 19 test, 14 docs, 5 chore, 2 refactor, 1 revert, 1 style, 1 ci. 332 files changed. No breaking changes.

Highlights

Slack setup you can actually follow

Connecting Slack no longer means guessing. The create page now generates a Slack app manifest with both request URLs filled in and links straight to Slack's app-creation flow. The credentials panel says where each credential actually lives in Slack rather than masking everything behind identical dots, and explains the empty conversation list and thread-mention behaviour instead of leaving them as surprises.

A message from an unverified sender used to be dropped silently. It now gets a reply — once per day per conversation — pointing at the Profile UI so the person can link their account.

Larger file uploads

The GFS upload ceiling moves 10MB → 16MB, matched across the desktop client, the browser client, and the gfsc write path. Getting there meant homologating timeouts at every hop (control-ui proxy, control-api→gfsc, the nginx funnel) at 300s, and raising control-api's memory ceiling: uploads arrive base64-in-JSON and are fully buffered, so a 16MB file transiently holds roughly five copies. At the old limit, two concurrent uploads OOM-killed the pod.

Plugin UI SDK

Plugins can render their own UI through a consented context bridge, and gfs:// links from a plugin now open in the Desktop viewer.

Desktop chat

Chats open at the latest message, with a scroll-to-bottom control that stays legible on hover and is scoped to the active chat.

Egress drift on GKE (#299)

External-egress FQDN resolution now accumulates over a sliding window instead of replacing the set each pass, fixing stale /32 drift. The resync interval must stay at or below half the overlap window, and HCC now fails closed at startup rather than silently drifting if that invariant is violated.

Connectors and secrets

Connector context membership and sharing are managed in place, creating a connector requires an explicit credentials choice rather than defaulting silently, and secret-provider availability is surfaced up front.

Reliability

Among the 73 fixes: control-api no longer 500s when a provider guard meets a missing channel or a non-string credential; enabling a provider without its credentials is rejected rather than half-applied; Slack targets whose Secret lacks a signing secret are hidden instead of offered; and the control-api DB migration Job now retries a transient lock timeout instead of failing the whole deploy.

Images

Release images are promoted, not rebuilt — release-images.yml copies the exact digests already proven on :latest into :v0.7.0, so they are byte-identical to what was tested.

v0.6.0 — pull published images, don't build them

v0.6.0

Promotes the dev integration branch to main and out to production. 449 non-merge commits since v0.5.0 (265 fix · 68 test · 38 feat · 29 docs · 13 ci · 12 chore · 11 perf · 7 refactor).

Highlights

make minikube-setup no longer builds images. It pulls them from ghcr.io/evenfire-ai, published for both linux/amd64 and linux/arm64. An Apple Silicon machine gets a native image without compiling ~23 services. make minikube-setup-local (or IMAGE_SOURCE=local) restores the previous build-everything path.

Release images are promoted, never rebuilt. Tagging v* copies the exact digests already proven on dev into the release tag, so what ships is byte-identical to what was tested. The promotion refuses any image that is not multi-arch.

One image manifest, one release writer. deploy/images.json is now the single source for every image list, and the ghcr deploy pin is a checked release coordinate alongside the desktop version, so the images a cluster pulls and the version it reports can no longer drift apart.

MCP servers move to registry distribution. They are installed on demand from the evenfire registry instead of being loaded into the cluster at setup.

Registry and connector work. Self-hosted Marketplace UX redesign with an org area, zero-touch auto-claim on registration with explicit recovery, derived registry auth gating, credential rotation for existing MCP connectors, and self-provisioned image-pull credentials for recipe workloads.

Per-agent GFS delegation. User-plane backend plus desktop UI, with bulk subjects[] grants.

Platform hardening. Authoritative fleet and MCP client hardening in mcp-host, a prereqs gate on setup, all 21 LLM providers plumbed into secrets, and unified model catalog and discovery in the Control UI.

Upgrading a local cluster

A fresh clone needs nothing beyond make minikube-setup. An existing cluster keeps the tag it last acquired, so pass MINIKUBE_IMAGE_TAG=v0.6.0 once, or rebuild the cluster, to move it onto the release images.

If minikube fails to start, MINIKUBE_MEMORY=9216 — the default requests more than a stock Docker Desktop ceiling allows.

v0.5.0 — host-wake hardening & security

v0.5.0

Promotes the dev integration branch to main and out to production. 71 non-merge commits since v0.4.0 (28 fix · 8 feat · 12 test · 10 ci · 7 docs · 4 chore · 1 refactor).

Highlights

Host lifecycle & wake hardening

• Bounded stateless wake, session continuity, and bundle cleanup; per-host reconciliation priority and wake-admission fixes.
• Fenced recovery-triggered Host delete against recreation (TOCTOU); scoped wake authorization preserved across held operations.
• Egress proxy: raised proxy_ssl_verify_depth so cross-signed root chains verify.

Security

• Patched Next.js vulnerabilities across the UI applications.
• SHA-pinned first-party GitHub Actions; tightened build/publish token scope to least-privilege.

Member registration

• Restored the member-registration revoke migration; fixed TSV and migration-script upsert paths.

Registry & Publisher UX

• Publisher default-on; hide the Publisher UI on OSS/self-hosted; publish imageRef identity fix; install Server-name Kubernetes default.

Setup & developer experience

• minikube setup rebuilds the DB by default; admin-password gate before full local setup; full-setup SIGPIPE fix; GFS allowed-contexts fix.

Licensing

• MPL-2.0 relicense finalized.

CI & tooling

• @claude on-demand responder (Sonnet + Opus 4.8); phase-3 pre-merge parity gates ported to public CI with leak guards; PR-merge Telegram notifications; dispatch built-image list.

Docs

• README redesign; LLM providers overview in the README.

Deploy

Production runs the exact image digests validated on dev at release time (per-service): control-ui, control-api/host-context-controller/rpc-proxy/workflow-recipes, profile-ui, and the channel-reader/external-rest-api/mcp-host/mcp-proxy/webhook-proxy group.

Full changelog: v0.4.0...v0.5.0

v0.4.0 — governed tracing + LLM provider registry

Highlights

• Platform-wide governed tracing — session replay, prompt-history capture, a trace-maintenance worker, and gateway ingest routes for governed agent-run events.
• LLM provider registry — per-provider credentials, per-session model selection, and an operator allowlist, via the new @clerum/llm-providers package.
• Member-registration runtime access completed — reconciles the least-privilege runtime role for member_registration_credentials (migration 0069).
• SSRF hardening — http_request now blocks IP-literal private targets.

Quickstart & deploy fixes

• control-ui CostShell builds correctly in the production image.
• make minikube-setup provisions the control-api / workflow-recipes / trace-maintenance runtime database roles, so those controllers start cleanly on a fresh cluster.
• Member-registration setup degrades gracefully when the (optional) sibling checkout is absent — it generates a local dev HMAC and continues instead of aborting.

Plus accumulated fixes since v0.3.0.

---

🤖 Generated with Claude Code

v0.3.0 — platform source parity + hardening

What's new

This release brings the open-source platform current with upstream development and hardens the release pipeline.

Full platform, caught up

The complete single-tenant platform source is now in sync with the development line:

• Stateless host lifecycle — idle hosts drain (reversible fence), suspend to zero replicas, and wake on demand; session state persists on the workspace PVC.
• Host-Context-Controller — a dedicated Kubernetes API client + CommunicationChannel watch-recovery.
• Registry connection mode — per-deployment registry connect + proof-of-possession signing, with a Control UI connect panel.
• Teams as a communication channel alongside Telegram / Email / Slack.
• SSRF hardening — http_request blocks private and cloud-metadata IP-literal targets (169.254.169.254, 127.0.0.1, [::1], …), not just DNS-resolved hosts.

Docs

New how-tos: connecting to and publishing on the registry, the MINIKUBE_MEMORY workaround for the 10 GB quickstart gotcha, and shared vs. global files.

CI / supply-chain hardening

The public build now fails if internal working artifacts or non-executable scripts are ever committed, and the publish tooling guards against leaking real identifiers, PII, and internal operational detail.

Install the CRDs

```bash
kubectl apply -f crds.yaml # attached — 8 clerum.io CRDs + WRC trigger RBAC
```
Or via the chart: `helm install clerum-crds ./charts/clerum-crds`.

Compatibility

`clerum.io/v1alpha1` remains alpha — breaking schema changes ship with migration notes.

v0.2.0 — MPL-2.0 open source

evenfire is now open source under MPL-2.0 🎉

The provisional "Apache-2.0 + additional use grant" license is replaced by the Mozilla Public License 2.0 — OSI-approved, file-level copyleft, no additional restrictions. Use it, modify it, self-host it, build commercial products on it. (This supersedes v0.1.0, whose tarball still carried the old license text.)

Getting started, rebuilt

• minikube-first onboarding: make minikube-setup stands up the full platform — operators, deny-all NetworkPolicies, JWT chain, seeded agent — in one idempotent command. The Docker Compose quickstart is gone.
• Provider auto-inference: setup now infers CLERUM_MODEL_PROVIDER from your single *_API_KEY, fails loudly on ambiguity, and defaults the model per provider — the #1 "my agent won't reply" footgun is fixed in code.
• Capability tour in the README: everything agents can do — shell/HTTP/browser/desktop tools with approval flags, PDF/Office/chart generation, MCP connectors, memory and recall, cron scheduling, workflows — each claim tied to the code that ships it, including the exact approval-flow wire format.

Docs & trust

• Diátaxis docs tree (get-started / how-to / concepts / FAQ / llms.txt)
• All six mcp-servers/ connectors documented with an honest status column
• Deep architecture: services & ports, token flows, L0–L3 NetworkPolicy layers
• Public claims-guardrails and a committed docs roadmap
• 10,000+ unit test cases across ~880 files; 268 E2E tests on real minikube + Calico

🤖 Generated with Claude Code

v0.1.0 — first public release

What's Changed

• fix(control-api): repair the imagePolicy base↔overlay boundary test by @jozer-rami in #2
• fix+docs: onboarding dry-run blockers, README rewrite, and Diátaxis docs tree by @jozer-rami in #1

New Contributors

• @jozer-rami made their first contribution in #2

Full Changelog: https://github.com/evenfire-ai/evenfire/commits/v0.1.0