v1.4.0

1.4.0 (2026-07-14)

Features

• gc: audit each purged deploy as system:gc (3291c36)
• gc: page on reconcile aliased_missing drift via Sentry issue (32793d4)
• handler: add h.audit helper + AuditStore interface (92f01de)
• handler: add HTTP request/duration/in-flight metrics (c5e5c08)
• handler: add logAction helper; log deploy.init with actor (0147f81)
• handler: add Sentry breadcrumbs at promote/finalize checkpoints (fb43d98)
• handler: audit all 11 destructive actions incl SiteRegister (f454a7b)
• handler: capture chi route pattern into access-log + Scope (d95c3c8)
• handler: convert mutating handlers to logAction with actor (dc75f2f)
• handler: emit action_total metric from logAction (2f262d4)
• handler: enrich upstream-error log + Sentry with actor/site/deployId (6f3cd6a)
• handler: log deploy.upload/finalize success with actor + bytes (38cf481)
• handler: log site.update with actor + before/after teams (b10095f)
• handler: set Sentry user on deploy-JWT routes (71bdbb6)
• handler: trace spans + breadcrumbs on destructive flows (e923416)
• handler: trace_id exemplar on http duration histogram (3291608)
• hatchet: capture worker task panics to Sentry via WithPanicHandler (64cbc0d)
• metrics: add audit_events_total counter surface (3c261dd)
• metrics: extend upload buckets past 10s + build_info gauge (a0ee63f)
• metrics: label tombstoned deploys by trigger (manual|scheduled) (7f8f26e)
• observability: force-sample destructive actions by raw method+path (0aca05d)
• observability: harden Sentry ClientOptions (ServerName, breadcrumbs) (fb8f193)
• observability: log workflow panics to slog, not just Sentry (dab5d89)
• observability: scrub breadcrumb message + nested data instead of dropping (bb1f12d)
• observability: scrub stdout logs via shared ScrubText/ScrubAttrs (5e44aa8)
• pg: add append-only audit_log table + RecordAudit (025cc73)
• server: retag Sentry tx name to method + chi route pattern (e5d81c8)
• telemetry: add reqID RoundTripper; thread reqID into pg lock/retry logs (b66d532)
• telemetry: add request Scope with mutex-guarded setters (cd8028c)
• telemetry: add trace_id/span_id to log lines from active span (560b198)
• telemetry: add WithSpan; instrument DeployFinalize dep calls (625af4c)
• telemetry: inject request-scoped attrs into every log line (35d5234)
• telemetry: propagate sentry-trace on outbound GitHub calls (b5f921a)
• worker: add duration histograms for workflows + relay (985353d)
• worker: mint run_id scope for cron/relay workflow firings (2257f01)
• worker: Sentry Crons check-ins on reconcile + purge crons (7e24151)

Bug Fixes

• backfill: keep first genuine byte error, ignore trailing cancel (9828d4a)
• gc: bound reconcile-scheduler publish with a deadline (091887f)
• gc: derive live-alias re-read key via <site> substitution (fc1df86)
• gc: downgrade self-healing reconcile/lock logs to Warn (4441eb1)
• gc: guard purge double-count + thread ctx through gc/handler logs (64057ff)
• gc: stop paging on self-healed aliased drift (1df5dbb)
• handler: drop duplicate actor log key (2127362)
• handler: lock SiteUpdate to fix audit race (f87c3c8)
• handler: map GitHub rate-limit to 429 at re-probe sites (40ed828)
• handler: populate access-log actor via shared request Scope (9c74c75)
• handler: record real deploy bytes in delete tombstone (df37b11)
• internal: do not init on non-template (#20) (51def46)
• main: wire h.Audit so audit_log persists for HTTP actions (f364f1a)
• observability: scrub secrets in error/stringer log attrs (5808b95)
• pg: release and surface stranded advisory unlock (00631fd)
• readyz: swap log levels to match client impact (31633b5)
• worker: add reconcile-scheduler cron producing site.reconcile events (fc72a64)
• worker: bound relay pass so a Hatchet stall frees pool + locks (9473578)
• worker: claim outbox rows FOR UPDATE SKIP LOCKED to stop cross-replica dup (cf9644a)
• worker: scale relay timeout with batch size (865a4fb)