v1.0.2 — Green CI/CD

[1.0.2] - 2026-07-24

The first release whose CI actually runs fully green end-to-end. After tagging v1.0.1, CI was still broken on that exact commit — gaps that had never surfaced before because the jobs that would have caught them (auth-service's own test suite, the worker job, sms-service's coverage gate) either didn't exist in CI or were never actually enforced until Day 95 turned them on for real.

Fixed

• auth-service and worker CI jobs had no Redis service container. auth-service's Prometheus metrics (Day 84) use a Redis-backed storage adapter, and worker's consumer tests create a real Redis Streams consumer group — both need Redis just to run their test suites, not just at runtime.
• sms-service's coverage thresholds (90%/80%/90%/90%) were failing at 87.8%/78%/86.8%/87.6% because metrics.controller.ts and metrics.middleware.ts (Day 84) had no tests at all. Added both; coverage is now 91.76%/80.53%/93.4%/91.6%.

v1.0.1 — CI fix

[1.0.1] - 2026-07-24

Fixes CI's lint job, which was failing on the exact commit v1.0.0 was tagged from — a pre-existing gap from Days 88/89 that was only caught after tagging: Locust wrote some scripts/load-test/results/*.csv files with CRLF line endings, and sdks/php/phpunit.xml used non-multiple-of-2 indentation, both violating .editorconfig. Since lint gates every other CI job (including publish-images), v1.0.0's tag push never actually published Docker images to GHCR. v1.0.0 itself is left as-is (already tagged and released); this patch release is the one whose CI actually runs green end-to-end. No functional code changes.

Fixed

• CRLF line endings in scripts/load-test/results/*.csv, converted to LF
• Non-2-space indentation in sdks/php/phpunit.xml, reformatted

v1.0.0 — Production-ready release

[1.0.0] - 2026-07-24

The v1.0 milestone (checklist Days 81–100): Kubernetes/Helm, full observability, hardened multi-tenancy, native SDKs, a complete OpenAPI reference, an extended CI/CD pipeline, a production deployment guide, and an end-to-end QA pass. No new services — this release hardens and completes the six services shipped through v0.4, rather than adding a seventh.

The v0.1 → v1.0 journey, briefly

• v0.1 — the core loop: capture, list/search, replay, a dashboard, Docker. sms-service (NestJS) and dashboard (React) only.
• v0.2 — auth-service (Laravel) and gateway (Go) join; API-key authentication enforced end to end, statistics, WebSocket live updates.
• v0.3 — provider-compatible endpoints (Vonage/SNS/MessageBird), multi-tenancy (organizations/teams), message templates, export. No new services.
• v0.4 — ai-service (FastAPI) and worker (Go) join; OTP detection, classification, spam detection, synthetic test-data generation.
• v1.0 — no new services; hardens and completes the six above for production use (this entry).

Added

• Multi-tenancy hardening (Day 86): audited every org-scoped query/endpoint across sms-service and auth-service — no gaps found, existing scoping already correct. Added the one real gap: per-org rate limiting at the gateway (gateway/internal/middleware/ratelimit.go), an in-memory fixed-window limiter keyed on org id (falling back to owner id), default 300 req/min, configurable via RATE_LIMIT_PER_MINUTE.
• Security review (Day 87): POST /api-keys/{apiKey}/rotate in auth-service (generates a fresh key/secret, revokes the source key); closed an input-validation gap in the SNS provider adapter (unbounded field lengths/types); documented the env-vars-only secrets management decision (see docs/security.md).
• Load testing (Day 88): Locust scripts (scripts/load-test/) against the gateway found every request serializing to a ~14s median latency floor regardless of load — traced to scripts/dev-up.sh starting auth-service via php artisan serve, single-threaded by default, throttling the whole stack since both the gateway and sms-service validate every request against it. Fixed by properly enabling PHP_CLI_SERVER_WORKERS (Laravel's ServeCommand silently ignores it without --no-reload); latency dropped to ~3.2s median, ~7x throughput in the same environment. See docs/load-testing.md.
• 4 native SDKs (Days 89-92): PHP (smspit/sdk, ext-curl), Go (github.com/jmrashed/SMSPit/sdks/go, net/http), Node.js (@smspit/sdk, global fetch), Python (smspit, urllib) — each with send/list/get/replay, no third-party HTTP dependency, and verified live against a running instance, not just mocked tests. Cross-SDK docs at docs/sdks.md (Day 93).
• Full OpenAPI reference + docs site (Day 94): docs/openapi/openapi.yaml covers every endpoint across the gateway, sms-service, and auth-service; validated with Redocly CLI. A Swagger UI docs site (docs/openapi/site/) renders it, verified live with Playwright. Documents 2 real inconsistencies found rather than hiding them (the MessageBird adapter's missing length constraints, and the unauthenticated API key management routes).
• Extended CI/CD (Day 95): .github/workflows/ci.yml gained test jobs for gateway, worker, ai-service, dashboard, and all 4 SDKs (previously only auth-service's migration — never its own tests — and sms-service ran); a publish-images job (GHCR, matrix over all 6 services) gated on v* tags; a deploy-staging job running the Day 82 Helm chart behind a staging GitHub Environment.
• Container registry (Day 96): GHCR chosen (zero extra secrets — authenticates with the workflow's own GITHUB_TOKEN). See docs/registry.md.
• Production deployment guide (Day 97): docs/production-deployment.md covers Compose and Kubernetes/Helm deployment, an env var reference, and scaling notes. Found and fixed a real bug while writing it: the Helm chart's default image.repository values still pointed at unpublished smspit/* names instead of the Day 96 GHCR names.
• End-to-end QA pass (Day 98): manually verified every major feature against a live stack. Found and fixed a real bug: the 3 provider-compatible adapters were completely unreachable through the gateway (/providers/* was never routed — an entire v0.3 feature, invisible to anyone going through the intended public entry point). See docs/qa-day98.md.
• Docs refresh for v1.0 (Day 99): README's "planned" framing (left over from the v0.1 draft) replaced with accurate status throughout — Features, Quick Start, REST API (including a real PATCH→PUT template-endpoint documentation bug fix), Roadmap; added CONTRIBUTING.md.

Known gaps

• Docker images are published to GHCR by CI on this tag push (see docs/registry.md); the 4 SDKs are not yet published to their package registries (Packagist/pkg.go.dev/npm/PyPI) — no registry credentials in this environment, see docs/sdks.md.
• No Docker/Podman/kubectl/helm binary was available in the environment this release was built in — every Docker/Kubernetes-related claim above was verified by an equivalent means (host toolchain builds, live process replication, manifest parsing) rather than a real docker compose up/kubectl apply/helm install. Re-verify the first real deployment against docs/production-deployment.md.