codex-pooler: v0.6.0

0.6.0 (2026-08-12)

Features

• admin: expose metrics authentication state (7ada8d5)
• admin: show runtime firewall session state (de3bd07)
• dev: capture Task14 websocket product stages (90e3f49)
• dev: secure upstream account bundle transfer (7645670)
• gateway: gate routing hints on credential provenance (7af05b3)
• ingress: add explicit forwarded client policy (1652d3a)
• ingress: expose firewall denial telemetry (6f3db40)
• mcp: support the 2026-07-28 protocol (cacc0cd)
• observability: expose reset confirmation phases (5645e43)
• security: retain bounded ingress peer provenance (0b482bf)

Bug Fixes

• admin: align serving-mode permissions (514d001)
• admin: clarify runtime firewall route scope (0e6962f)
• admin: complete firewall session state coverage (fe7ea2d)
• admin: correct quota and saved reset meter states (c263d90)
• admin: describe bridge ring rendezvous ordering (c8dbe44)
• admin: explain applied reset quota confirmation (d549738)
• admin: keep provider quota authoritative across reset precision (c6085c2)
• admin: render unknown quota meters as static (da65a05)
• admin: show request serving-mode metadata (5298761)
• api: validate Codex Responses continuations (3bf3a3e)
• catalog: avoid duplicate-key errors on pricing reimports (1913451)
• deps: update dependency @astrojs/starlight to v0.41.7 (#265) (c1bea14)
• deps: update dependency apexcharts to v6.7.1 (#274) (246faf8)
• deps: update dependency apexcharts to v6.8.0 (#275) (0995ed1)
• dev: preserve lifecycle command PATH (32d8002)
• dev: recover stale local server receipts (8ea0df0)
• dev: recover verified legacy server state (aea8f49)
• dev: report Task14 observer event drops (ad1bd39)
• dev: resolve impeccable live helper from its handshake file (439acec)
• dev: retain Task14 observations without client request ids (92ed765)
• dev: retain Task14 response correlations per request (23dc9f2)
• dev: scope impeccable live constants to the dev-features guard (ef8553f)
• dev: size the Task 14 product observer for a real round (e7e457a)
• dev: use the bootstrap owner for bundle imports (0aa55b9)
• docs: enforce ingress boundary contract (3bbea63)
• gateway: align Codex compaction forwarding (0873589)
• gateway: cancel abandoned websocket work across topologies (4cf4b18)
• gateway: close abandoned upstream websocket requests (4988adb)
• gateway: define Codex serving-mode selection (b2fab3e)
• gateway: emit Codex overload wire errors (3eceded)
• gateway: enforce image generation policy in dispatch (51ad37a)
• gateway: preserve native Lite request content (d433507)
• gateway: preserve reasoning replay continuations (3454f89)
• gateway: preserve schema properties during marker cleanup (b168f22)
• gateway: preserve schema-bound tool outputs (190a430)
• gateway: preserve trusted credential provenance (75c8031)
• gateway: retain valid encrypted reasoning (fdf553c)
• gateway: snapshot serving mode for image retries (5f56721)
• gateway: stagger websocket owner lease renewals (c9bd890)
• ingress: add canonical runtime path classification (0d29c8d)
• ingress: bound forwarded client resolution (28d9391)
• ingress: enforce configured forwarded client source (0b68691)
• ingress: enforce decoded runtime path boundaries (2487c2a)
• ingress: enforce strict canonical IP rules (f68ae51)
• ingress: fail closed on unavailable settings (16ce194)
• ingress: reuse forwarded client resolution (b3d3311)
• mcp: align unsupported protocol error messages (bb67216)
• mcp: suppress non-remainder quota balances (2e00690)
• monitoring: scope firewall denial dashboard (3b8dbc7)
• openai: adapt explicit prompt cache controls (7ae45e7)
• preserve quota and credit state convergence (5966d7d)
• quota: derive freshness at read time (79eb794)
• quota: normalize freshness evidence aliases (799c3da)
• quota: preserve explicit account reset provenance (d54383f)
• responses: accept custom tools inside namespaces (245e280)
• responses: clarify namespace tool validation error (77cb8fd)
• responses: preserve reasoning replay content (7e44dcc)
• routing: bind circuit completions to admitted probes (61006b1)
• routing: record attempt-owned circuit recovery outcomes (791d844)
• routing: score reported-percent exhaustion as empty (844b737)
• saved-resets: close post-consume convergence handoff (1bc9f83)
• saved-resets: defer burns for recoverable circuit siblings (21bf4b3)
• security: bind local browser trust to the immediate peer (e9580ba)
• security: enforce ingress firewall for pruned runtime routes (67fbefd)
• security: reject malformed immediate peer addresses (2da890e)
• security: validate preserved peer addresses with OTP (e0f3c02)
• settings: make instance cache self-healing (d16895d)
• settings: remove unsupported database setting env aliases (2ba2287)
• test: isolate database state and expected logs (64c5f42)
• upstreams: parse Cloudflare cookie dates without httpd (e69a78e)
• usage: omit synthetic credits metadata (d8c1579)
• usage: require all emitted quota windows to allow (7552c20)
• v1: centralize pool compatibility authorization (baed23c)
• websocket: revoke sockets after firewall updates (578b90a)

Performance Improvements

• gateway: compile test settings overrides out of production (10fba6e)

Miscellaneous Chores

• release 0.6.0 (e719fbe)