Skip to content

v1.8.0 — deploy-path repair after the v1.7 hardening

Choose a tag to compare

View all tags
@mrobinson2 mrobinson2 released this 21 Jul 10:27
· 67 commits to main since this release
v1.8.0
1d37d9c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The v1.8 line continues in v1.8.1, which adds agent peer identity and the identity map at admission — the agent half of the canonical-peer work. It is not contained in this tag; it landed after v1.8.0 was cut. If you are adopting v1.8, take v1.8.1.

A repair release, not a feature one. v1.7 hardened the platform's security posture; applying that hardening to a real subscription then broke the paths that install and update it. Every item here is a defect found by running the thing, plus the guard that makes it fail loudly next time.

No new features, no new flags, no migrations. If your environment is deployed and healthy, v1.8 changes what happens the next time you build an image, seed a vault, or deploy from scratch.

Deploy-path repair

  • Fresh deploys work again after the Deny-by-default firewalls (#122). A clean-subscription apply died mid-Pass-2 with ForbiddenByFirewall on the Key Vault data sources and a 403 on file-share reads — after plan-time reads had succeeded, so it failed with billable resources standing. Azure Container Apps is not a Key Vault trusted service, so an IP allowlist alone never covers in-VNet callers: the app subnet now carries Microsoft.KeyVault/Microsoft.Storage service endpoints and is allowlisted. Storage ip_rules rejects /32. PostgreSQL 15 names the throttling parameter connection_throttle.enable.
  • The paperclip image is buildable again (#128). scripts/build-and-push.sh hardcoded its own copy of the vendored PaperClip pin, which stopped matching the Dockerfile at the v2026.707.0 bump — and --build-arg beats an ARG default, so every build silently cloned the old upstream and then aborted on a workspace package that version does not ship. Both values now come from one place.
  • CI green again (#127, #130). Two gitleaks false positives in docs/notes/, allowlisted with condition = "AND" so only those literals are exempt and only there.

Drift guards

  • A DSN whose user is not the server admin now fails at seed time (#129). Postgres answers a username mismatch with FATAL: password authentication failed for user "..." — the message names the password and sends you to the wrong secret. In the reference deployment that cost a six-day outage. seed-keyvault.sh now validates both DSN secrets against the expected administrator_login, including values kept from an earlier run, which is the path the drift actually took. Offline --self-check runs it in CI.

Dependencies

  • services/honcho → python:3.14-slim-bookworm (#125), reversing the v1.7 revert now that local-stack-smoke passes on 3.14; astral-sh/uv 0.11.29 (#126); actions/setup-node 7 (#123).
  • The services/paperclip 3.14 bump (#124) is not in this release — its smoke job still fails.

Scope note

The v1.7 tag was cut 2026-07-11, before the reliability-hardening merges (#112–#117) reached main. Those are documented under the v1.7 milestone and are contained in this tag; the v1.8 notes cover only what is new since that documentation.

Full notes: docs/releases/v1.8.0.md

Assets 2
Loading