v1.0.0 — operable free-path edge

v1.0.0 — operable free-path edge

What shipped

• Quota policy as data: config/quota_policy.json defaults to 30 requests / 60s per key
  (matches historical GATEWAY_RATE_LIMIT=30/min); per-key overrides; blank path falls back to env.
• Audit export: journal ?format=jsonl with meta + entry lines; salted key_id only;
  fixture dev-local never appears in export body (tested).
• Proxy honesty: offline respx fixtures for research compare, mao replay, repomind refs/history;
  chaos for sibling 429 / application 502 / connect / timeout with request_id preserved.
• Preview discipline: dry-run script; production upstreams remain empty (ADR-0004).
• Operate: runbook (unconfigured / 401 storm / preview→prod), load artifact (health+401 only,
  single isolate), CASESTUDY ≥1500 words, season ledger docs/SEASON.md.

Hosted honesty (must stay true)

• Public host: https://pax-ai-gateway.vercel.app — P5 only, four unconfigured.
• Status path: /v1/platform/status (not /v1/status).
• No global 429 claim (rate_limiter.scope = process without Redis).
• Fly remains PLANNED (billing blocks free deploy theater).
• Agents do not set production upstream env.

Verify

curl -s https://pax-ai-gateway.vercel.app/health
curl -s https://pax-ai-gateway.vercel.app/v1/platform/status   # 401
curl -s -H "X-API-Key: dev-local" https://pax-ai-gateway.vercel.app/v1/platform/status
# four unconfigured
curl -s -H "X-API-Key: dev-local" "https://pax-ai-gateway.vercel.app/v1/platform/journal?format=jsonl&limit=5"
# no raw keys

Offline: pytest (quota policy, audit export, proxy contracts, chaos).
Load: python scripts/load_public_edge.py --n 120 → docs/assets/load.json.

Still PLANNED after v1.0.0

• Fly.io multi-region gateway if billing unblocks.
• Deployment-wide 429 on public Vercel without intentional Redis.
• Durable multi-tenant audit / SIEM shipping.
• OAuth / enterprise IdP.
• Token-bucket limiter (shipped algorithm remains fixed window).
• P1 public host integration on production gateway.

v0.3.0

v0.3.0 — proxy contracts and preview-only upstreams

What shipped

• Week 1 · edge hygiene: security headers; Redis connect/command timeouts + port from URL;
  journal never stores raw keys (including the published dev-local fixture); backend-neutral
  429 docs; hostname-required upstream URLs; OpenAPI still documents /v1/platform/status.
• Week 2 · proxy contracts: respx + committed fixtures under tests/fixtures/siblings/ for
  P2 /v1/research, P3 /v1/tasks, P4 /v1/code/*. Empty URL → typed upstream_unconfigured.
  Transport failure → typed upstream_down. Sibling 5xx body pass-through + request id.
  Production stays empty: ADR-0004.
• Week 3 · preview recipe: PREVIEW-UPSTREAMS.md. Production env
  is not wired. Status UI keeps unconfigured first-class and never claims four systems hosted.

Hosted honesty (unchanged)

• Public host: https://pax-ai-gateway.vercel.app — P5 only, four unconfigured.
• No global 429 claim. Fly remains PLANNED.
• No sibling URLs in committed deployment files.

Verify

curl -s https://pax-ai-gateway.vercel.app/health
curl -s https://pax-ai-gateway.vercel.app/openapi.json | head -c 200
curl -s -H "X-API-Key: dev-local" https://pax-ai-gateway.vercel.app/v1/platform/status
# four unconfigured
curl -s -H "X-API-Key: dev-local" https://pax-ai-gateway.vercel.app/v1/research
# 503 upstream_unconfigured

Offline: pytest (includes test_proxy_contracts and test_journal_never_contains_the_published_fixture_key).

v0.2.0 — weeks-depth platform edge

v0.2.0 — weeks-depth platform edge

Release date: 2026-08-14

Scope

The free-path gateway was already public, git-connected, and honest about empty upstreams
(v0.1.0). This release makes the edge look like a platform engineer built it: request journal,
complete OpenAPI with typed failure examples, a limiter protocol with optional Redis, OTel as a
seam, and upstream URLs that stay unconfigured unless env says otherwise.

What shipped

Week	Surface
1	In-process journal (GET /v1/platform/journal), complete OpenAPI, typed 401/429/413/415 tests, README curl block on the correct status path
2	RateLimiter + InMemoryLimiter + optional RedisLimiter, ADR-0002, decision counters on /metrics
3	Tracer / NullTracer / optional OTel console exporter, optional *_URL validation, status UI treats unconfigured as first-class, CASESTUDY + ADR-0003

Hosted claim (unchanged honesty)

• Live: https://pax-ai-gateway.vercel.app (Vercel, per function instance)
• Correct status path: /v1/platform/status (not /v1/status)
• Fixture key: dev-local (published, not a credential)
• Public env leaves four upstream URLs, GATEWAY_REDIS_URL, and GATEWAY_OTEL empty
• Fly remains PLANNED
• No claim of deployment-wide 429 on the public host

Verify

curl -s https://pax-ai-gateway.vercel.app/health
curl -s -H "X-API-Key: dev-local" https://pax-ai-gateway.vercel.app/v1/platform/status
curl -s -H "X-API-Key: dev-local" "https://pax-ai-gateway.vercel.app/v1/platform/journal?limit=5"
curl -s https://pax-ai-gateway.vercel.app/metrics
curl -s https://pax-ai-gateway.vercel.app/openapi.json

AI Platform v0.1.0 — a visible policy edge

AI Platform v0.1.0 — a visible policy edge

The fifth portfolio system turns four independent AI projects into optional upstreams behind one
tested operations boundary. The default demo runs the gateway alone for $0.

Included

• open gateway health; protected platform status
• four explicit prefix rewrites and bounded health probes
• API-key authentication with the public dev-local fixture
• per-key in-memory rate limits with Retry-After
• propagated/generated request IDs
• typed 401, 413, 415, 429, 502, and 503 failures
• accessible local status console
• body-size and log-redaction guardrails
• gateway-only Docker image and an honest optional Compose profile

Honest boundary

The release proves gateway behavior using mocked upstreams. It does not deploy P1–P4, claim
production traffic, or claim that composing the systems improves answer quality. Distributed
quotas, hosted TLS/key rotation, and an end-to-end multi-service deployment remain PLANNED.

Free path

py -3.12 -m venv .venv
.\.venv\Scripts\python -m pip install -e ".[dev]"
.\.venv\Scripts\python -m uvicorn gateway.main:app --port 8080
Invoke-RestMethod http://127.0.0.1:8080/v1/platform/status -Headers @{"X-API-Key"="dev-local"}