DataContractGate v0.4.1

What's Changed

• API: truthful rate-limit headers, Bearer-key hint, 415 on non-JSON, shorter echoes (0.4.0 retest) by @nightmoose in #253
• Dashboard: Audit Log example route, no Loading… on pricing (0.4.0 retest) by @nightmoose in #251
• CI: build the image once, cache Rust deps, deploy without rebuilding by @nightmoose in #252
• Verify email links server-side so reset works in any browser by @nightmoose in #254
• Pre-launch blockers: inference, deleted-contract ghost (cross-org deploy), rate-limit headers, retire fly.dev host by @nightmoose in #255
• Dashboard polish: account self-service, sign-out, billing, empty state, 404, security headers by @nightmoose in #259
• Fix publish 23503: contract_publications.org_id FK -> orgs (migration 041) by @nightmoose in #260
• Disable Kafka/Confluent ingress by default (Confluent account closed) by @nightmoose in #262
• Sharing polish: stable import, link-token 403, catalog ref, revoke codes, org ID (no unpublish UI) by @nightmoose in #261
• Staging: fly.staging.toml (contractgate-api-staging) + staging workflow docs by @nightmoose in #263
• Rate limit: confirm per-second semantics, exactness tests, doc fixes (R-L5, R-L3) by @nightmoose in #257
• Tester small items: one-value enums, legacy-host probes, deprecated-pin 422 (R-X2, R-S3) by @nightmoose in #258
• Collaborate access: 403 role denials (C2), collaborator read (C3), OpenAPI (O2), revoked import 404 (R3), /me, comment delete by @nightmoose in #264
• Collaboration keyed by contract id (migration 042, not applied) by @nightmoose in #265
• Copy: Kafka/Kinesis streaming is Enterprise-only, available on request by @nightmoose in #267
• Deprecated pins consistent (D1), editor writes by id (N2), DELETE proposal by @nightmoose in #266
• Gate Kafka/Kinesis dashboard tabs at Enterprise by @nightmoose in #268
• Server-side Enterprise gate on Kafka/Kinesis streaming routes by @nightmoose in #269
• Kafka/Kinesis ingress routes: enforce contract ownership by @nightmoose in #270
• Staging fixes from Tessie's test: ownership-before-plan, version pin normalisation, OpenAPI paths by @nightmoose in #271
• Promote staging: streaming Enterprise gate, ingress ownership fix, pin normalisation by @nightmoose in #272
• Reject equivalent contract versions; echo requested_version on normalised pins by @nightmoose in #273
• ODCS import targets an existing contract; no duplicate-named contracts; v1 path pin source by @nightmoose in #274
• Stored contract YAML version always matches its version row by @nightmoose in #276
• Import: target name in stored YAML, keep comments, version/export OpenAPI by @nightmoose in #277
• ODCS: preserve nested object properties and array item schemas by @nightmoose in #278
• Promote staging: ODCS import into existing contract by @nightmoose in #275
• feat(integrations): OpenMetadata result publisher + ODCS contract sync by @nightmoose in #279
• OpenMetadata follow-ups: cleanup, seed fix, scope, screenshots by @nightmoose in #280
• Promote staging: OpenMetadata integration by @nightmoose in #281
• feat(odcs): strict ODCS v3.1.0 export/import (CsvPath + OpenMetadata portability) by @nightmoose in #282
• Promote staging to main: strict ODCS v3.1 export/import (#282) by @nightmoose in #283
• examples/odcs-joint: joint CsvPath orders example + CsvPath research by @nightmoose in #284
• Report redacted replays, effective payload storage, and fail closed on silent DB waits by @nightmoose in #285
• Fix CodeQL alert: bound org-wide replay allocation by @nightmoose in #287
• Fix CodeQL #84: don't pre-size replay outcomes from request by @nightmoose in #288
• Promote staging to main: replay redaction, Free payload flag, request timeouts (#284, #285) by @nightmoose in #286
• WORKING: store quarantine bodies when the reported payload flag is on by @nightmoose in #289
• WORKING: remove quarantine rows when a contract is deleted by @nightmoose in #290
• WORKING: OpenAPI coverage, contract payload flag, paid-plan message by @nightmoose in #292
• Promote staging: paid payload storage fix (#289) + quarantine cleanup on contract delete (#290) by @nightmoose in #291
• WORKING: document OpenAPI response schemas and staging host by @nightmoose in #293
• Promote staging: OpenAPI response schemas + staging host doc fix (#293) by @nightmoose in #294
• WORKING: omit forwarded event bodies when payload storage is off by @nightmoose in #296
• WORKING: gate replay audit bodies and stamp the caller org by @nightmoose in #297
• Add cursor-paged GET /v1/contracts/{id}/passed by @nightmoose in #298
• Purge forwarded payloads and fix passed-event paging by @nightmoose in #299
• Keep a passed-event resume cursor and count forwarded purges by @nightmoose in #300
• Sync main into staging (resolve squash-promotion conflicts) by @nightmoose in #303
• Release: forwarded_events privacy, replay audit fixes, passed-events API (#296-#300) by @nightmoose in #301
• Sync main into staging (resolve squash-promotion conflicts) by @nightmoose in #304
• WORKING: Connect Fivetran into the customer's account by @nightmoose in #302
• WORKING: check Fivetran credentials before minting a key by @nightmoose in #305
• WORKING: readable Fivetran table names and fail-closed connect origin by @nightmoose in #306
• WORKING: use roles instead of bot names by @nightmoose in #308
• WORKING: document Fivetran connect gaps and report paid features on /me by @nightmoose in #309
• Release: Connect Fivetran (#302, #305, #306) by @nightmoose in #307
• Document Fivetran connect 413, 400 text, and ASCII slugs by @nightmoose in #310
• WORKING: state Fivetran connect works on paid plans and self-host by @nightmoose in #311
• WORKING: gate Connect Fivetran on paid_features from /v1/me by @nightmoose in #313
• Release: Fivetran docs, self-host clarity, dashboard gate (#310, #311, #313) by @nightmoose in #312
• WORKING: self-host cold login unlocks paid features by @nightmoose in #314
• AGENTS.md: operational handoff for any coding agent by @nightmoose in #256
• WORKING: self-host restart + safe defaults by @nightmoose in #315
• Release: self-host works cold, restart-safe, safe defaults (#314, #315) by @nightmoose in #316
• Name the Fivetran product DataContractGate by @nightmoose in #317
• Release: Fivetran user-facing text says DataContractGate (#317) by @nightmoose in #318
• Remove test prompts file containing revoked keys by @nightmoose in #320
• Remove test prompts file containing revoked keys by @nightmoose in #323
• Remove internal review and test-plan notes from the public repo by @nightmoose in #322
• Use DataContractGate in public prose and UI text by @nightmoose in #321
• Move internal admin app and internal notes out of the public repo by @nightmoose in #324
• Scrub internal notes and names from public docs by @nightmoose in #325
• Sync main into staging to unblock the release PR by @nightmoose in #327
• Release: public-repo cleanup (#321-#325) by @nightmoose in #326
• Harden workflows, images, and Rust dependencies by @nightmoose in #328
• Import ODCS v3.2 property enums and add dual-brand guardrails by @nightmoose in #329
• Release: security hardening (#328), ODCS v3.2 enums, MCP registry metadata, and SDK/integration recipes (#329) by @nightmoose in #331
• Add AISchemaGate agent rules and retitle the MCP listing by @nightmoose in #336
• RFC-106: Streaming chunk validation for AISchemaGate by @nightmoose in #337
• Add AISchemaGate Python framework adapters by @nightmoose in #339
• Release: AISchemaGate rule templates and MCP 0.4.1 metadata (#336) by @nightmoose in #338
• Make the MCP listing findable for structured-output searches by @nightmoose in #340
• Bump released packages to 0.4.1 by @nightmoose in #344
• Release v0.4.1 by @nightmoose in #345

Full Changelog: v0.4.0...v0.4.1