Skip to content

v9.14.0 - segment-scoped policies, SCIM-resolved segments, and a hardened upgrade preflight

Choose a tag to compare

View all tags
@saurabhjain1592 saurabhjain1592 released this 04 Aug 10:28
v9.14.0
c0f09b5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v9.14.0 - segment-scoped policy targeting, SCIM-resolved segments, and a hardened self-hosted upgrade preflight

This release adds the first increment of segment-scoped policy targeting on the agent request plane, resolves governance segments from SCIM group membership, hardens the self-hosted upgrade preflight, and fixes an organization-binding bug in the policy-test preview. /health now advertises the current recommended SDK and plugin versions.

Highlights:

  • Segment-scoped static policy targeting on /api/request. A static policy can now carry a segment_id (nullable, added by migration core/157), and the caller's resolved governance-segment set participates in policy selection. Selection is strictly additive: rows without a segment_id behave exactly as before, and a segment-scoped policy can only add or tighten a restriction, never loosen one. A genuine segment-resolution error fails the request closed; an empty resolution proceeds organization-only. Nothing changes until a segment-scoped row exists (rows are authored via SQL for now).

  • Segments resolve from SCIM group membership for a validated per-user identity, organization-scoped on both the user and the group row. Zero memberships is success (an empty set); a query error fails resolution closed rather than degrading to role-only. In-process cache with a clamped TTL; errors are never cached, and resolution outcomes are covered by metrics.

  • The self-hosted upgrade preflight now answers the upgrade questions from the running old stack. It names every policy row an upgrade migration will disable (with paste-ready recovery SQL, recoverable only before the migration runs), validates DEPLOYMENT_MODE on the agent and the orchestrator separately, sizes the migration lock window by measurement, and reports the CORS deny-by-default consequences. The query layer fails closed: results never travel through command substitution, existence probes use pg_catalog rather than the privilege-filtered information_schema, and a parity guard keeps the bundled copy byte-identical.

  • Security: the policy-test preview (POST /api/policies/test) now binds its organization scope from the authenticated context instead of a caller-influenced identifier, matching the enforcement plane. On deployments where the license organization and the tenant string legitimately differ, this also fixes previews that silently resolved no segment-scoped policies.

  • /health advertises recommended SDK version 9.1.0 for Go, Python, TypeScript and Java (Rust stays 0.8.1) and openclaw plugin version 2.8.5. The 9.1.0 SDK minors are published as part of this release: they add the real audit read-model wire fields (policy_decision, policy_details, response_time_ms, action) additively and deprecate request_type, so no existing field is removed or renamed and 9.0.0 clients keep working unchanged. The plugin min and recommended versions now come from one shared package read by both planes, so the agent and orchestrator can no longer drift apart on plugin advice.

  • In-repo documentation stamps (getting-started, the SDK and guide headers, and the compatibility matrix) now state the current platform version and the real SDK coordinates.

Migration: one additive migration, core/157 (nullable static_policies.segment_id; NULL on all existing rows, no behavior change until a segment-scoped policy is authored). No data mutation. Take the usual pre-upgrade snapshot.

Assets 2
Loading