AxonFlow v11.4.0

[11.4.0] - 2026-11-05: Hosted acquisition and bounded outcome foundations

Platform release with new capabilities kept dark or sandbox-only. The
website-first Hosted purchase path and customer-neutral action contracts are
included, but this release does not activate a production provider action or
change a customer's execution authority. Compatible client patches ship in
the coordinated release train.

Community

Changed

• Keep the new capability route family unavailable in Community with an explicit
  501 response. Existing client and workflow behavior remains compatible.
• Carry additive core capability-usage schema and indexes without enabling an
  Enterprise capability or changing Community billing.
• Report the version baked into Agent images consistently on /health.

Fixed

• Keep Agent /health unavailable until startup migrations and route
  registration finish. A migration failure now stops startup instead of leaving
  a healthy-looking task; the Compose health budget allows this guarded boot to
  complete before declaring the Agent unhealthy.

Enterprise

Added

• Add a verified, website-first Hosted account path: one-use email verification
  creates the tenant and owner only after consumption, then a tenant-bound Portal
  session can start Checkout, complete onboarding, and link a client or device.
• Record tenant-scoped Checkout attempts, expiry and cancellation observations,
  signed completion, and conversion attribution. A browser return alone never
  grants an entitlement; an expired session can be replaced safely.
• Add a versioned, customer-neutral Agent capability and external-action
  reference with bounded discovery, governance, evidence, durable reservation,
  delivery and reconciliation contracts. Live capability registration, customer
  authority enrollment, and provider Send remain disabled.
• Add an explicit sandbox-only, tenant-scoped read-only registry for payment-case
  and FinCrime investigation. The Portal can show separate advisory capability
  usage when durable events exist, while empty tenants see no invented usage.
• Add evidence-linked synthetic payment-exception, support-refund, and
  failed-disbursement workflows and buyer-labeled replay reports. These use fake
  provider actions and make no customer outcome or savings claim.

Fixed

• Keep Hosted sign-in, paid entitlement, revocation, tenant erasure, MCP
  metering, and event replay tenant-bound through error, retry, cancellation,
  and billing-outage paths. Preserve structured 402 and 429 refusals.
• Require fresh policy authorization on cached capability replay; reject
  unbound tenants, absent customer authority, or mismatched grants. Preserve
  typed policy denials through the synthetic refund gateway.
• Limit advisory model output to sourced, bounded suggestions. Displayed facts
  and unknowns come from deterministic evidence, so injected source text cannot
  claim that a refund was approved or sent.

Operations

• Guard existing Hosted stack updates with full live-parameter preservation,
  explicit account and stack identity, digest-pinned task images, and an audited
  no-execute change set. Applying a production preview requires the exact
  retained change-set ARN and source, parameter, and processed-plan fingerprints.
• Add guarded staging DNS lifecycle and teardown procedures. No DNS or
  production resource changes are made by the release source itself.

Migration and compatibility

• Apply additive core migrations 192–194, Enterprise migrations 162–165, and
  Community SaaS migrations 199–204 before the new Agent tasks start. The new
  tables and columns enforce tenant RLS where applicable. Retain the prior
  database snapshot as the rollback anchor; image rollback does not reverse
  schema migrations.
• Keep existing client minimum floors. Recommend the verified public 9.5.1
  Python, Go, TypeScript and Java SDKs, Rust 0.12.1, OpenClaw 2.10.3,
  Claude Code 1.14.0, Cursor 1.10.0 and Codex 1.10.0. These client patch
  releases carry Hosted policy-verdict and packaging fixes; they do not enable
  new action authority, which remains closed pending customer-specific
  evidence and a separate activation gate.

[11.3.7] - 2026-10-29: Published client compatibility reconciliation

Platform metadata patch. This release reconciles the plugin versions
advertised by both /health planes with the public artifacts verified during
the Hosted Starter release train. It does not change minimum-version floors,
request handling, authorization, billing, or tenant isolation.

Community

Fixed

• Recommend OpenClaw 2.10.1, Claude Desktop 0.4.1, and Google ADK 1.4.0 from
  the shared compatibility registry after those artifacts completed their
  public release and production-compatibility checks. Agent and Orchestrator
  continue to project the same copied map by construction.
• Keep the customer-facing Agent and Orchestrator OpenAPI examples in lockstep
  with the canonical registry and pin the reconciliation in the regression
  test. All other SDK and plugin recommendations remain at their verified
  public versions.

Enterprise and AxonFlow Hosted

Migration and compatibility

• No database migration, environment, SDK, plugin, or client configuration
  change is required from v11.3.6. Existing clients remain compatible, and
  every minimum-version floor is unchanged.

[11.3.6] - 2026-10-28: Stripe webhook delivery compatibility

Hosted platform-only patch. This release restores paid entitlement
activation for legitimate Stripe webhook deliveries after Stripe expanded
its published source-address set. Client contracts, capability negotiation,
SDK floors, and recommended SDK/plugin versions are unchanged.

Community

• No self-hosted Community runtime behavior changes. The public release remains
  in lockstep because the shared platform version is the compatibility anchor.
• Express the existing MCP session-limit audit classification as an equivalent
  tagged switch so the current static-analysis release gate remains green; this
  is a behavior-preserving refactor.

Enterprise and AxonFlow Hosted

Fixed

• Admit all 15 webhook delivery addresses currently published by Stripe while
  preserving the finite source allowlist, rightmost ALB-forwarded client-IP
  selection, per-source rate limit, request-body cap, and mandatory
  Stripe-Signature verification. The previous list omitted three legitimate
  addresses, so a successful Checkout could redirect the buyer while the Agent
  rejected the signed activation event before signature verification.
• Require an exact regression assertion for every currently published Stripe
  webhook address and add a release/cohort gate that compares the built-in list
  with Stripe's authoritative list. Acceptance now requires ordered webhook
  delivery and an active entitlement with a future paid-through timestamp; a
  Checkout success redirect alone is not sufficient.
• Correct the capability registry's platform-version stamp, which remained at
  11.3.4 while the v11.3.5 release surfaces had advanced.

Operations

• Keep the staged Community Compose build-context guard portable across GNU
  and BSD/macOS mktemp, so the release workstation can execute the same
  fail-closed mirror simulation used by the Linux release runners.

Migration and compatibility

• No database migration, SDK, plugin, or client configuration change is
  required from v11.3.5. Existing clients remain compatible.

[11.3.5] - 2026-10-28: Clean Hosted schema rollout correction

Hosted platform-only patch. This release fixes two clean-stack rollout
defects found by the production-shaped v11.3.4 staging gate. Client
contracts, capability negotiation, SDK floors, and recommended SDK/plugin
versions are unchanged.

Community

• No self-hosted Community runtime change. The public release remains in
  lockstep because the shared platform version is the compatibility anchor.

Enterprise and AxonFlow Hosted

Fixed

• Accept the legitimate absence of three legacy child tables whose creation
  migrations are outside the Community SaaS selector. If an older Hosted
  database contains any of those tables, startup still requires ENABLE/FORCE
  RLS and both permissive and restrictive tenant-bound policies. Every required
  Hosted table and the dynamic tenant-table census remain fail-closed.
• Force a new timestamped Community SaaS stack through the master-credential
  bootstrap when environment-scoped application-role DSN secrets are already
  enabled. Operators then rotate/provision both database roles against the new
  RDS instance and update the same stack to the app-role posture. This prevents
  stale DSNs from a deleted stack from entering new ECS tasks.

Migration and compatibility

• No database migration or client change is required from v11.3.4. The patch
  changes only Agent startup verification, deployment preflight, and the Hosted
  launch runbook. Existing clients remain compatible.

[11.3.4] - 2026-10-28: Dependency security remediation

Security patch. This platform-only release upgrades the shared Go JOSE
parser used by OIDC verification and the Jackson dependencies used by
Enterprise Java examples. Client contracts, capability negotiation, SDK
floors, and recommended SDK/plugin versions are unchanged.

Community

Security

• Upgrade github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 across the
  application modules, the gateway-adapters health-probe build, and the
  source-built MinIO image to remediate
  CVE-2026-116587, a denial-of-service condition while parsing JWK sets that
  contain crafted RSA keys. The parser remains at the same shared OIDC
  verification boundary. RSA issuer keys up to and including 4096 bits retain
  their existing behavior; larger moduli are now deliberately refused at parse
  time under the upstream safe default.

Fixed

• Keep Community mirror validation compatible with the two explicitly mirrored
  HTTP connector runtime E2Es while still rejecting a partial authoring-fixture
  set, scope the RLS-grant parity check to its own excluded suite, and keep the
  Enterprise-only Hosted refund handler test out of the public source tree.
  Preserve the mirror simulator as a reusable classification oracle through an
  explicit synthetic-fixture opt-in while failing closed when the real source
  tree omits or partially carries the HTTP connector harness, and execute both
  connector harnesses against a real Community Agent with disposable
  PostgreSQL, Redis, and loopback HTTP fixtures.

Enterprise and AxonFlow Hosted

Security

• Apply the same Go JOSE upgrade to Enterprise and Customer Portal module
  graphs so agent, orchestrator, Portal, gateway-adapters, and source-built
  MinIO images do not retain the vulnerable transitive version.
• Upgrade the Jackson BOM and direct Jackson overrides used by Enterprise Java
  examples from 2.22.1 to 2.22.3, resolving the fixable HIGH advisories reported
  by the release-candidate filesystem scan.

Migration and compatibility

• Correct Enterprise Java examples to consume the current SDK's circuit-breaker
  update response type, pull-request identifier accessor, and MAS FEAT
  materiality-classification accessor.
• No database migration or configuration change is required from v11.3.2 or
  v11.3.3.
  Existing clients remain compatible; minimum and recommended SDK/plugin
  versions are unchanged.

[11.3.3] - 2026-10-28: HTTP connector reliability and Hosted workflow acceptance

Platform-only patch. This release preserves existing client contracts,
capability negotiation, SDK floors, and recommended SDK/plugin versions. No
SDK, plugin, or integration package release is required.

Community

Fixed

• Preserve URL filters when adding HTTP connector query parameters. Query
  execution now starts from the request URL's existing query string, retains
  unrelated and repeated values, skips internal parameters, and lets explicit
  connector parameters replace only matching keys.
• Retry transient HTTP failures for idempotent writes. PUT and DELETE now
  retry configured transient status codes as well as transport failures,
  preserving the complete request body on every attempt and returning the
  final response when the retry budget is exhausted. Non-idempotent POST and
  PATCH requests are not retried on HTTP status failures.

Enterprise and AxonFlow Hosted

Operations

• Record the accepted production workflow sub-gate. The checked-in Hosted
  profile now records the reviewed safe-off production workflow acceptance,
  making authenticated live Checkout-session creation available while paid
  enforcement remains off and the cohort remains zero during deployment and
  acceptance. This marker does not weaken RLS, grant an entitlement, or move
  money by itself.

Fixed

• Include the Community HTTP connector query-preservation and idempotent-write
  retry corrections above in the Enterprise platform image.

Migration and compatibility

• No database migration or configuration rename is required from v11.3.2.
  Existing clients remain compatible; minimum and recommended SDK versions are
  unchanged.

[11.3.2] - 2026-10-28: Hosted global-audit RLS correction

Safe-off patch. This patch corrects a production audit-loss defect found
during the v11.3.1 hostile rollout review. It does not enable the paid gate,
a public cohort, or real-money movement. See the
v11.3.0 release notes
for the feature release and the
v11.3.1 release notes
for the first rollout-safety patch.

Community

• No self-hosted Community runtime change. Released in lockstep at v11.3.2
  so Community and Enterprise retain contiguous public tag histories. The
  runtime correction below is specific to AxonFlow Hosted's split application
  and platform-admin database roles.

Enterprise and AxonFlow Hosted

Security

• Preserve global control-plane audit rows under Hosted FORCE RLS. Global
  AUTH_SUCCESS, AUTH_FAILURE, and tenantless SCIM denial events deliberately
  carry org_id=NULL; the Hosted tenant policy therefore rejects them on the
  axonflow_app_role pool. Customer Portal now sends only those fixed-shape,
  non-tenant audit writes through the existing axonflow_platform_admin pool.
  Tenant-scoped request traffic remains on the NOBYPASSRLS application pool,
  and no RLS policy is weakened.
• Audit tenantless SCIM rejection at the authentication boundary. An empty
  tenant token is still refused before reaching a handler, but the same
  boundary now records SCIM_MISSING_TENANT rather than relying on an
  unreachable handler callback.

Operations and testing

• Bound failed admin-authentication decisions independently from successful
  operator traffic. Over-budget refusals remain audited, while a correct key
  cannot be locked out by failed traffic sharing its NAT or proxy bucket.
• Add real-PostgreSQL regression proof for the exact Hosted posture: FORCE RLS
  rejects the global row on axonflow_app_role, the unchanged policy admits no
  cross-tenant exception, and the BYPASSRLS platform-admin pool stores the row.
• Keep the paid gate off until the v11.3.2 production deployment passes fresh
  log-loss, billing-route, workflow, RLS, rollback, and payment-canary gates.

[11.3.1] - 2026-10-28: Hosted rollout safety corrections

Safe-off patch. This patch corrects defects found by the first v11.3.0
production rollout. It does not enable the paid gate, a public cohort, or
real-money movement.
See the v11.3.0 release notes
for the complete feature release; this entry contains only the patch delta.

Community

• No platform runtime change for self-hosted Community. Released in
  lockstep at v11.3.1 so Community and Enterprise keep contiguous tag
  histories. The rollout fixes below apply only to AxonFlow-operated Hosted
  infrastructure; the shared source keeps its version and release notes
  aligned.
• Keep the Spring Boot example dependency floor enforceable. Update its
  regression guard for the v11.3 move to Spring Boot 4.0.9, whose reviewed
  dependency management resolves Tomcat 11.0.27. The guard now rejects either
  an older parent or an unsafe explicit override instead of requiring the
  retired Tomcat 10.1 override and leaving the release branch permanently red.

Enterprise and AxonFlow Hosted

Security

• Complete the production Hosted RLS catalog. Community SaaS migration 197
  gives three legacy parent-scoped child tables a forced restrictive tenant
  guard and restores tenant-scoped usability to legacy direct-key tables that
  had a restrictive guard but no permissive policy. The migration mirrors the
  existing restrictive expression rather than creating an allow-all policy.
  Startup now explicitly requires the three child stores so dropping their last
  policy cannot make them disappear from the dynamic census.

Operations and migration

• Restore Hosted daily-quota accounting under forced RLS. Community SaaS
  migration 198 scopes the atomic tenant counter update to the authenticated
  tenant argument and restores the caller's prior database scope. Quota-store
  failures now return 503 instead of being mislabeled as paid-tier 429s.
• Make the enforcement canary provider-free and evidenceable. Synthetic MAP
  requests now honor skip_llm, execute a deterministic local step through the
  governance gate, use a benign control when an upstream proxy denial would
  prevent plan creation, and tolerate the older provider-fallback window during
  a rolling deployment.
• Make the production CloudFormation template executable. Quote numeric
  operands in Rules-section Fn::Equals expressions. CloudFormation rejects
  non-string rule operands before changing resources even though its template
  validator and cfn-lint accept them; a mutation-proof repository gate now
  covers the exact failure shape.
• Deploy the released platform before public clients. The Hosted launch
  runbook now requires safe-off production migrations, RLS, billing-route,
  rollback, and oldest-supported-client compatibility proof before SDKs,
  plugins, integrations, docs, or landing changes are published.
• Apply Community SaaS migration 197 after migrations 192-196. Keep the paid
  gate off and acceptance/module settings empty until the remaining launch
  gates are accepted.

CI / Testing (this repository only)

• Keep Enterprise-only CloudFormation coverage out of the Community mirror.
  The v11.3.1 Rules regression reads templates under infrastructure/ and
  ee/, which the public sync intentionally strips. Exclude that test from the
  staged Community tree so its anti-vacuity guard remains meaningful instead
  of making the public regression suite fail over subjects it cannot contain.

---

Full release notes: https://docs.getaxonflow.com/docs/releases/v11-4-0