v9.8.0 — timezone-safe timestamps + reconciled API reference

[9.8.0] - 2026-07-10 (agentgateway PEP adapters, TIMESTAMPTZ retype, API-reference reconciliation)

Minor. v9.8.0 makes AxonFlow directly consumable as the Policy Decision Point behind an agentgateway (or any Envoy-based) data plane: a new Enterprise adapter binary serves agentgateway's three external-PDP seams — ExtMcp, Envoy ext_authz, and Envoy ext_proc — translating each into Decision Mode verdicts and engine-backed redaction with the platform's fail-closed postures intact. On the fix side, every remaining timezone-naive TIMESTAMP column is retyped to TIMESTAMPTZ (41 columns across 19 tables), closing a class of wrong-instant bugs on deployments whose database session zone is not UTC, and the published API reference (OpenAPI specs plus the Enterprise API pages) is reconciled with the shipped platform surface. One core migration (142) and one enterprise migration (133), both with down migrations and an upgrade-path test covering existing banking/SaaS databases. No SDK or plugin releases ride this train; the advertised compatibility matrix is unchanged from 9.7.0.

Added

• agentgateway / Envoy PEP adapters. (Enterprise) A new gRPC adapter binary (axonflow-gateway-adapters) lets an agentgateway data plane call AxonFlow as its Policy Decision Point across all three of the gateway's external-PDP seams: ExtMcp (MCP tools/call governance with engine-mutated tool params and results), Envoy ext_authz (headers-only allow/deny), and Envoy ext_proc (streaming body inspection with engine redaction of the buffered request body and check-output governance of the response body). The adapters contain zero local policy or redaction logic — every verdict and every mutated byte comes from the engine — and enforce the platform's postures: the request plane defaults to fail-closed (the fail-open opt-in applies only to an unreachable PDP; an engine 4xx or an unfulfillable redaction obligation always blocks, and the headers-only ext_authz seam denies rather than forwards when a verdict carries a redaction obligation it cannot fulfil), while the response plane is unconditionally fail-closed, including when the engine reports redaction was not evaluated. Deny responses carry the decision and trace ids for audit correlation, inbound bearer tokens are passed to the PDP for validation, and a bounded circuit breaker fails fast per plane posture when the engine is repeatedly unreachable. Requires a PDP at platform 9.7.0 or later (the check-output redaction_evaluated contract). Ships in the enterprise build, with a reference agentgateway configuration covering all three seams in the runtime-e2e harness; the shared Go PEP package gains a CheckOutput response-governance round-trip with its wire shape pinned by contract tests.

Fixed

• Timezone-naive timestamp columns retyped to TIMESTAMPTZ. (Community) 41 TIMESTAMP (without time zone) columns across 19 tables — sessions, API keys, gateway contexts, audit and violation logs, organizations, connectors, evidence exports, and others — stored wall-clock digits with no offset, so components reading or writing them under a non-UTC session silently shifted instants (the original symptom: gateway pre-check approvals expiring at the wrong moment on non-UTC hosts). Core migration 142 retypes the shared tables and enterprise migration 133 the five enterprise-only ones, each in a single transaction with the conversion timezone pinned to UTC regardless of the session zone, dependent views dropped and recreated around each retype — including existence-guarded handling of the banking-vertical retention views that would otherwise abort the migration on upgrades of existing banking/SaaS databases — and exact down migrations. Defensive UTC normalization is added at the confirmed local-time write sites (gateway pre-check expiry and the audit-queue writers), and the test/demo/bootstrap schema copies plus the connector registry's fallback DDL are updated to match. An upgrade-path test applies the real per-mode migration chains to an existing-release database pinned to a +05:30 session zone and asserts stored instants convert exactly and round-trip through the down migrations.
• API reference reconciled with the shipped platform surface. (Community) The four OpenAPI specs in docs/api/ (agent, orchestrator, policy, MAS-FEAT) and the Enterprise API reference pages had drifted from the shipped code: phantom paths that never existed (unprefixed MCP check routes, top-level accuracy/conformity families, circuit-breaker activate/deactivate), missing shipped endpoints (audit session-summary, audit export and report, the OJK module, the dynamic-policies family, OTLP metrics/logs ingest, the full HITL surface), and wrong shapes (the audit-search response envelope, check-output response fields, the circuit-breaker schema). Every documented operation is now verified against handler source, the MAS-FEAT spec is re-wired into the OpenAPI CI gates it had silently dropped out of, and the agent spec is kept in lockstep with the path-template registry used by analytics (enforced by a regression test). The EU-AI-Act endpoint family the reconciliation had initially removed is restored as documented proxied endpoints — those routes are real and served through the agent's proxy to the orchestrator.

Changed

• The agent spec now states the single-entry-point contract explicitly. (Community) docs/api/agent-api.yaml carries a cross-reference note that every /api/v1/* endpoint is reachable through the agent — the deployment's single entry point — and that endpoints the agent transparently proxies to the orchestrator are documented in orchestrator-api.yaml, rather than duplicating the roughly twenty proxied endpoint families into the agent spec and maintaining both copies in lockstep.

Full notes: https://docs.getaxonflow.com/docs/releases/v9-8-0