docs(release): v1.8.0 — deploy-path repair after the v1.7 hardening - #131
Merged
Conversation
v1.7 hardened the security posture; applying that hardening to a real subscription then broke the paths that install and update the platform. v1.8 collects the repairs and the guards that make the same class of breakage fail loudly next time. Adds docs/releases/v1.8.0.md (fresh-deploy firewall/PG15 fix, the paperclip build-pin drift, the DSN username guard and its six-day outage, the gitleaks allowlists, dependency bumps, upgrade notes), a README section framing it as a repair release rather than a feature one, a ROADMAP "v1.8: shipped" section, and the release badge. The v1.7 tag was cut before the reliability-hardening merges (#112-#117) reached main, so those are documented under v1.7 and contained in this tag; v1.8.0.md covers only what is new since that documentation. Renames the horizon section to post-1.8 and adds the still-open services/paperclip Python 3.14 bump (#124) to it — its smoke job fails, so it is explicitly not in this release. The notes describe the demo feature-flag false positive rather than quoting the string: the allowlist that exempts it is scoped to docs/notes/, so reproducing it here would fail the scan, and widening a security allowlist to accommodate prose is the wrong trade. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mrobinson2
force-pushed
the
docs/v1.8-release
branch
from
July 21, 2026 10:25
8364c8f to
d593d7e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this release is
A repair release, not a feature one. v1.7 hardened the security posture; applying that hardening to a real subscription broke the paths that install and update the platform. v1.8 collects the repairs, plus the guards that make the same class of breakage fail loudly next time.
No new features, no new flags, no migrations. For an already-deployed healthy environment, v1.8 changes what happens the next time you build an image, seed a vault, or deploy from scratch.
Contents
docs/releases/v1.8.0.md— grouped notes: deploy-path repair (Fix fresh deploys: ACA-through-KV-firewall subnet endpoints, PG15 parameter rename #122, fix(build): read the paperclip upstream pin from the Dockerfile, not a stale copy #128, fix(ci): stop gitleaks flagging Slack's docs placeholder in design notes #127, docs(notes): preserve the v1.7 merge-and-release plan alongside its siblings #130), the DSN username guard (feat(seed): fail loudly when a Postgres DSN's user is not the server admin #129) and the six-day outage that motivated it, dependency bumps (build(deps): bump actions/setup-node from 6 to 7 #123, build(deps): bump python from 3.13-slim-bookworm to 3.14-slim-bookworm in /services/honcho #125, build(deps): bump astral-sh/uv from 0.11.28 to 0.11.30 in /services/honcho #126), and upgrade notes.README.md— a "The v1.8 release" section above the v1.7 milestone, the release badge, and a docs-table row.ROADMAP.md— a "v1.8: shipped" section; the horizon section becomes post-1.8 and picks up the still-openservices/paperclipPython 3.14 bump.Scope note
The v1.7 tag was cut 2026-07-11, before the reliability-hardening merges (#112–#117) reached
main. Those are described in the v1.7 milestone docs and are contained in this tag, sov1.8.0.mdcovers only what is new since that documentation — otherwise the same work would be enumerated twice.services/paperclipPython 3.14 (#124) is deliberately excluded and named as excluded: its smoke job still fails.🤖 Generated with Claude Code