Kody v2026.08.05

Kody v2026.08.05

This release is about trust infrastructure — the stuff you hope you never need but are glad is there. There's a new public status page, durable queue-backed event delivery for packages, and a wave of disaster-recovery hardening that means your email and workflow data are now backed up, restorable, and protected against the kind of deploy accidents that keep operators up at night. The pre-launch legacy elimination program also crosses its final documentation milestone.

New

• There's now a public status page at status.heykody.dev. It runs on a completely separate worker so it stays up even if the main worker is down, checks every component once a minute, shows 90-day uptime bars per component, and opens/resolves incidents automatically with email alerts. You can bookmark it, subscribe to it, and check it during outages instead of wondering. (#1230)

• Package events are now delivered through a durable queue instead of synchronous in-request fan-out. When a package emits an event, Kody validates it, enqueues it, and returns immediately — delivery happens asynchronously with exactly-once idempotency keys so redelivery replays instead of re-running. Events can now declare a payloadSchema so subscribers can discover payload shapes, subscription filters actually work, and payloads are capped at 64 KiB. Local dev and preview environments fall back to inline delivery through the same code path, so nothing breaks when the queue binding isn't present. (#1229)

Improved

• Your email and workflow data are now included in disaster-recovery backups. The nightly DR exporter now stages per-user Mailbox exports and RunLog observability records alongside the existing database backups, with checksummed NDJSON, resumable chunking, and seal-time verification. You won't notice this day-to-day, but if something ever goes wrong, your email graph and run history are recoverable. (#1231)

• Operators can now recover individual user data from point-in-time snapshots. Recovery RPCs are available on Mailbox, RunLog, UserMeter, and StorageRunner objects with a 30-day window, gated behind a maintenance secret and exact identity verification. The tooling ships ahead of need — during an incident nobody should be writing recovery code live. (#1226)

• D1 backups that can't actually be restored now fail closed. Exports containing SQL statements above Cloudflare's import limit are rejected before sealing, so you never discover a backup is unrestorable at the worst possible moment. The control-plane dashboard shows restorability as yes/no/unknown. (#1225)

• Deploy-time guardrails now block destructive migrations before they run. A new check rejects Durable Object migrations with unreviewed class deletions or binding changes, and gates destructive CLI commands (wrangler delete, d1 delete, etc.) behind an explicit operator-triggered workflow. Adding to the allowlist is itself a reviewed code change — that's the whole point. (#1224)

• 145 migration files collapsed into a single baseline. The schema doesn't change — this is bookkeeping and repo-history surgery only — but a deterministic guard verifies the pre-squash state before rewriting bookkeeping, and a stale checkout fails fast on its first CREATE TABLE instead of silently re-applying history. Two documented ghost rows from pre-ledger-era renames are accepted by the guard without masking any missing history. (#1227, #1228)

• Legacy infrastructure from the pre-launch cleanup is now fully removed. Quiescent jobs observability columns are dropped, the email post-drop approval and inbound-effects tables are gone, and the remaining D1 entitlement narrows are reaped so no runtime path treats D1 as a package-service or account-write authority. RunLog is the sole source for job state, Mailbox is the sole authority for your email, and UserMeter is the sole authority for entitlements. (#1215, #1216, #1217)

Fixed

• Spurious Sentry errors from Fathom Analytics no longer create noise. A Chromium removeChild-on-null TypeError thrown by Fathom's beacon cleanup after SPA navigation is now filtered at the Sentry layer — real removeChild bugs in app code still report normally. (#1232)

• Documentation now describes the system as it is today, not how it got there. The final rollout-narration residue across Mailbox, RunLog, UserMeter, storage, and package-guardrail docs is replaced with present-tense contracts, and the temporal-language checker now catches additional stale-cutover phrases that kept slipping in. (#1218, #1219, #1220, #1221, #1234)