Grid v0.2.2

Container Images

ghcr.io/praxis-proxy/ai:0.7.0@sha256:550661eea7e392a9f4415b836e0b2393299f26856bc02cbbc8d3301d49b759f3
ghcr.io/praxis-proxy/grid-operator@sha256:43a4c14fb3497cf273654ddd9322d6d57af546fe54eb1e1e9674e5c11ec5d0a6
ghcr.io/praxis-proxy/grid-gateway@sha256:9cc6573fe782a8c43883d57052cb87f3a343c803cb379a97a742036941ca725c
ghcr.io/praxis-proxy/grid-mock-providers@sha256:f0f08bc7056409a35875d73e8936cbb41868c7a4ccd995b73430df88bd0e6800
ghcr.io/praxis-proxy/grid-enrollment@sha256:c8688bee140c44ed095b25e8526983f2444632b8773f7b0a8e8e8aca0a976829
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:f9916091d5c4b704a8f302759b454bb09a7022ba2047dc5f2359fc965fb12357

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.2.2
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:74a0df7be9256a0901623061f057e970883d0b1bc181ffc99680231aeb95ee48
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.2.2
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.2.2
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.2.2
oci://ghcr.io/praxis-proxy/charts/grid-enrollment --version 0.2.2

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.2.2 \
  --namespace grid-system --create-namespace

The Grid images were built from 33cb906be2bb0ebdbaf253bd307939a44f41b37b. The Praxis AI
image was verified from the organization-owned image above at
praxis-proxy/ai@6f058ec9d4037441b42530da4d9e54a05e5a6d34.
Every reference above is immutable.

Distributed token quota image requirement

Grid publishes the routing topology and qualification for distributed
token quotas, but the standard Praxis AI 0.7.0
container does not include the optional token-rate-limit-filter
feature. Basic Auth is present, but deployments using the quota example
must supply a Praxis AI image built with the token-rate-limit filter.
Grid does not publish a replacement AI rollup.

What's Changed

• build(deps): bump the cargo-minor-patch group with 4 updates by @dependabot[bot] in #417
• build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @dependabot[bot] in #413
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #415
• build(deps): bump the cargo-minor-patch group in /crates/gateway with 3 updates by @dependabot[bot] in #416
• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #414
• build(deps): bump rustls-webpki, webpki-root-certs and webpki-roots for RustSec by @hexfusion in #422
• fix: keep unreachable sites routable under poll by @hexfusion in #420
• refactor(chart): harden grid-gateway values by @zdtsw in #233
• feat(operator): publish discovered models in provider status by @evacchi in #389
• fix(operator): avoid plaintext fallback on SWIM key read errors by @evacchi in #418
• feat: Go Kubernetes API types for Grid CRDs by @valeriiashapoval in #388
• fix(chart): confine the enrollment chart's Secret grants by @hexfusion in #423
• chore(release): prepare Grid v0.2.2 by @hexfusion in #425

New Contributors

• @valeriiashapoval made their first contribution in #388

Full Changelog: v0.2.1...v0.2.2

Grid v0.2.1

Container Images

ghcr.io/praxis-proxy/ai:0.7.0@sha256:550661eea7e392a9f4415b836e0b2393299f26856bc02cbbc8d3301d49b759f3
ghcr.io/praxis-proxy/grid-operator@sha256:07577c673ba688b24d4e2e43ecdb0ce412fd34ef8017c429e97ff599153a8521
ghcr.io/praxis-proxy/grid-gateway@sha256:a4f8a5e858e08b56359ff12ff507abec0b6e26a2a0bf41e0c7f0943126dde35c
ghcr.io/praxis-proxy/grid-mock-providers@sha256:cf95451d4f04c8e5c6bca80c2b9bca439370abe29b840f1c959b79bf73d9e210
ghcr.io/praxis-proxy/grid-enrollment@sha256:7a2088244733c6220abf5f07d47b979615695fe40ab729e1c578c2ae948af782
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:b2a94ab608544e41ba40f709e567bd3e6341584830472a23c82b4aead22ac2e0

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.2.1
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:8a83a40c257359576b3205e429ce42e06f101391dd6da39cdf9a16ca08e636ac
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.2.1
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.2.1
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.2.1
oci://ghcr.io/praxis-proxy/charts/grid-enrollment --version 0.2.1

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.2.1 \
  --namespace grid-system --create-namespace

The Grid images were built from 5963265023d825d8410cfccbb52ea42334bb4e8c. The Praxis AI
image was verified from the organization-owned image above at
praxis-proxy/ai@6f058ec9d4037441b42530da4d9e54a05e5a6d34.
Every reference above is immutable.

Distributed token quota image requirement

Grid publishes the routing topology and qualification for distributed
token quotas, but the standard Praxis AI 0.7.0
container does not include the optional token-rate-limit-filter
feature. Basic Auth is present, but deployments using the quota example
must supply a Praxis AI image built with the token-rate-limit filter.
Grid does not publish a replacement AI rollup.

What's Changed

• feat(routing): publish and serve no-route revisions by @nerdalert in #270
• fix: preserve distributed state convergence and publication bounds by @shaneutt in #325
• fix(xtask): parse static-weighted capacity publications by @nerdalert in #329
• build: replace bundled Forge with pinned upstream tooling by @shaneutt in #326
• refactor: move fleet dashboard under crates by @shaneutt in #330
• docs(chart): explain values normalization intent by @shaneutt in #334
• feat(gateway): read every site's load from the local operator only by @hexfusion in #336
• test(gateway): match the serving example's single local operator peer by @hexfusion in #345
• fix(xtask): load local images into kind under podman by @hexfusion in #335
• docs: add grid metrics by @hexfusion in #340
• feat(operator): derive consumer endpoint topology from allowlisted providers by @hexfusion in #341
• fix(operator): do not evict providers on oversized /metrics bodies by @zdtsw in #351
• chart(operator): render gatewayRefs[].consumerConfig from gateway.consumerConfig by @hexfusion in #353
• feat: install the operator from a generated platform base and start a gateway on the generated config by @hexfusion in #354
• ci: add selectable triggered release qualifications by @nerdalert in #332
• feat(enrollment): record each enrollment as a CertificateSigningRequest by @hexfusion in #360
• fix(deps): alias serde_yaml to yaml_serde in the root workspace by @hexfusion in #369
• fix(chart): scope the operator's Deployment grant to delegated gateways by @shaneutt in #339
• test(xtask): qualify weighted final-provider withdrawal by @nerdalert in #357
• test(gateway): routing conformance by @hexfusion in #373
• fix(signals): keep healthy providers ready during slow scrapes by @zdtsw in #352
• test(xtask): qualify cross-site llm-d signals and fix route attribution by @nerdalert in #358
• chore: replace typographic dashes with plain ASCII by @shaneutt in #338
• fix(chart): seed AWS sites from their peers' SWIM endpoints by @shaneutt in #331
• refactor: move remaining crates and align build configuration by @shaneutt in #327
• fix(gateway): report rejected ages to the local operator by @shaneutt in #372
• build(deps): bump spiffe from 0.16.1 to 0.18.0 by @dependabot[bot] in #380
• build(deps): bump the cargo-minor-patch group with 5 updates by @dependabot[bot] in #379
• build(deps): bump the cargo-minor-patch group in /crates/gateway with 4 updates by @dependabot[bot] in #377
• build(deps): consolidate rand and hmac upgrades by @nerdalert in #383
• feat(gateway): kv cache saturation with ceiling by @hexfusion in #375
• fix(chart): retain bootstrap RBAC across hook runs by @zdtsw in #346
• feat(client): unified HTTP client logic by @hexfusion in #349
• fix(enrollment): harden the signer's admission and storage by @hexfusion in #347
• fix(signals): keep relayed ages right across clock steps by @shaneutt in #342
• fix(operator): surface rejected gateway signal ages by @shaneutt in #371
• feat(enrollment): reconcile SiteInvite resources by @hexfusion in #382
• test(xtask): qualify llm-d learned ceiling lifecycle by @nerdalert in #385
• fix(gateway): prefer fresh pressure over learned ceilings by @hexfusion in #386
• fix(deploy): add AWS NLB patch overlay for OpenShift by @hexfusion in #390
• deps(gateway): pin Praxis AI with Praxis 0.7.4 support by @hexfusion in #392
• fix(gateway): migrate health listener to metrics_address by @zdtsw in #393
• refactor(crd): rename Grid API fields by @zdtsw in #268
• fix(chart): cloud-neutral load balancer Services by @hexfusion in #399
• fix(deploy): scrape the operator on OpenShift by @hexfusion in #400
• refactor(operator): SSRF-safe endpoint resolution (probes+model discovery) by @evacchi in #364
• feat(gateway): expose prefix affinity cache limits by @hexfusion in #391
• fix(chart): declare the gateway's clusters and serve its metrics by default by @hexfusion in #401
• fix(signals): read local load at 1s and poll the operator at 1s by @hexfusion in #403
• fix(gateway): clean up integration issues by @hexfusion in #384
• feat(operator): name the site from its identity and create its records by @hexfusion in #402
• chore(release): prepare Grid v0.2.1 by @hexfusion in #407

Full Changelog: v0.2.0...v0.2.1

Grid v0.2.0

Container Images

ghcr.io/praxis-proxy/ai:0.4.0@sha256:0f619d4a0b533093f94a76921cfbba0ecdec51557dffee1615a29721ee1fc878
ghcr.io/praxis-proxy/grid-operator@sha256:9ae617ed04d93521860b1efeab8cd7ed39801bb79a6217d55678a11431147fbc
ghcr.io/praxis-proxy/grid-gateway@sha256:3b6679e885fb9a4ef9fa8b8fb7214de36648e649cbb80722a296b87ea1ce9f42
ghcr.io/praxis-proxy/grid-mock-providers@sha256:888bf04a00f6366427ae87f6178a9023509056d2305bc72b93ed0c8919d84fdf
ghcr.io/praxis-proxy/grid-enrollment@sha256:9d73ea9dee05a5e5d09437f05b42a903c867341a28c22f6e053e142693118170
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:897bbd5e97e413ce174966a5812e71f0f2a9cb96346fca49faf8eaa46dc1ae54

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:a541abbaab220fd63e2eac2cbad367996b82c837f26bb0370e6fbfec3713746b
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-enrollment --version 0.2.0

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.2.0 \
  --namespace grid-system --create-namespace

The Grid images were built from a4a7d7168ec36e59f31bcb9be0d11d6dd69c4974. The Praxis AI
image was verified from the organization-owned image above at
praxis-proxy/ai@ca3e760c790a34293c03d2314a3c7cfbf73836b3.
Every reference above is immutable.

Distributed token quota image requirement

Grid publishes the routing topology and qualification for distributed
token quotas, but the standard Praxis AI 0.4.0
container does not include the optional token-rate-limit-filter
feature. Basic Auth is present, but deployments using the quota example
must supply a Praxis AI image built with the token-rate-limit filter.
Grid does not publish a replacement AI rollup.

What's Changed

• ci: remove isolated GLB release check by @nerdalert in #118
• test(quota): wait for serving overlay revision by @nerdalert in #120
• test(glb): harden provider withdrawal qualification by @nerdalert in #121
• test(llmd): make pressure qualification deterministic by @nerdalert in #122
• test(quota): isolate qualification runs by @nerdalert in #123
• fix(quota): isolate Forge runtime state by @nerdalert in #124
• test(glb): make drain and attribution proofs strict by @nerdalert in #125
• build(deps): bump the cargo-minor-patch group with 2 updates by @dependabot[bot] in #128
• build(deps): align kube with k8s-openapi 0.28 by @nerdalert in #129
• build(deps): upgrade aes-gcm to 0.11.1 by @nerdalert in #130
• feat(swim): resolve DNS endpoint hostnames by @nerdalert in #138
• feat(operator): add administrative provider drain by @nerdalert in #126
• feat(routing): add static weighted provider selection by @nerdalert in #142
• feat(operator): cross-site provider signals via a grid-wide signalTransport by @hexfusion in #147
• build(deps): bump the cargo-minor-patch group with 4 updates by @dependabot[bot] in #149
• feat(enrollment): standalone single-use site-token enrollment service by @hexfusion in #153
• fix(operator): guard GridSite status writes on controller-owned fields only by @hexfusion in #157
• feat(operator): opt-in FIPS OpenSSL TLS backend by @hexfusion in #148
• build(images): standardize Containerfiles on whole-workspace multi-stage builds by @hexfusion in #161
• feat(gateway): stub the praxis-grid-gateway operand by @hexfusion in #159
• build(deps): bump the cargo-minor-patch group with 3 updates by @dependabot[bot] in #182
• build(deps): bump sqlx from 0.8.6 to 0.9.0 by @nerdalert in #185
• build(deps): bump schemars from 0.8.22 to 1.2.2 by @nerdalert in #186
• fix(certs): run certificate keygen and hashing on the FIPS module by @hexfusion in #173
• docs: consolidate provider routing docs by @nerdalert in #188
• docs: clarify Grid gateway release contract by @nerdalert in #190
• chore(release): qualify main integration topologies by @nerdalert in #178
• Split the grid-gateway into its own workspace and bump praxis-proxy to 0.7 by @hexfusion in #194
• feat(enrollment): grid enrollment, issuance, SPIFFE verifier, chart, and e2e by @hexfusion in #201
• feat(grid): cross-site load routing over verified mTLS by @hexfusion in #203
• build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #206
• build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #207
• fix(enrollment): fail loudly on bootstrap misconfig instead of a bare NotPresent by @hexfusion in #209
• docs: adopt AI Grid Network branding by @nerdalert in #205
• build(deps): bump rmcp and related libraries by @nerdalert in #212
• chore(CRD): add shortnames to the Grid CRDs by @zdtsw in #213
• feat(deploy): add a kustomization for the CRDs by @hexfusion in #215
• fix(charts): allow enabled and global so operator and gateway work as subcharts by @hexfusion in #217
• render the gateway config from the chart with secure defaults by @hexfusion in #210
• feat(grid-enrollment): pin images by digest by @hexfusion in #225
• fix(charts): grid chart and enrollment fixes by @hexfusion in #229
• fix(CRD): correct generated manifests from the Rust types by @zdtsw in #214
• feat: operator auto-enroll from hub site invites by @hexfusion in #234
• feat(operator): SWIM across clusters and signals peer trust by @hexfusion in #237
• fix(scripts): read verification model from candidate name by @derekhiggins in #243
• fix(chart): pin the overlay-sync sidecar image tag to v0.1.4 by @zdtsw in #244
• feat(operator): poll providers for served models by @evacchi in #191
• feat(charts): install an enrolled hub and sites with helm by @hexfusion in #239
• ci: build each image once per commit and cache Rust deps per job by @hexfusion in #252
• fix(forge): treat podman's network inspect output as Docker's by @hexfusion in #253
• ci: test charts at the Helm 3.12 floor and add a chart upgrade e2e by @hexfusion in #242
• Chore: general fixes and cleanup for helm charts by @shaneutt in #255
• fix(operator): stop the GridNetwork status reconcile loop by @hexfusion in #249
• fix(gateway): initialize tracing so the gateway logs by @hexfusion in #250
• fix(operator): trust auto-discovered peers under spiffe peer trust by @hexfusion in #269
• fix(operator): two-site grid fixes by @hexfusion in #263
• feat(api): move the grid API group to grid.praxis.fast by @hexfusion in #257
• feat(gateway): apply serving config and identity changes without a restart by @hexfusion in #259
• feat(operator): join a grid from a single operator install by @hexfusion in #261
• fix(signals-client): poll peers through the process crypto provider by @hexfusion in #276
• charts and CI: log level, gateway probes, PVC annotations, workspace gates, and flake fixes by @hexfusion in #277
• feat(operator): metrics over TLS, authenticated EPP scraping, quieter logs, stub collection, and a site phase metric by @hexfusion in #278
• fix(ci): preload pinned images for triggered GLB E2E by @nerdalert in #280
• fix(gateway): stop the serving watcher applying one identity rotation twice by @hexfusion in #283
• chore(gateway): bump praxis to 0.7.3 and praxis-ai to 0.5.0 by @hexfusion in https://github.com/praxis-proxy/...

Grid v0.1.4

Grid v0.1.4 release notes

Grid v0.1.4 adds routing and integration support for provider selection groups and distributed token quotas.

Provider selection and load balancing

Grid publishes stable provider candidates and selection groups in the accepted routing overlay. Praxis AI performs request-time selection; with selectionPolicy: roundRobin, eligible provider gateways are selected in round-robin order. Grid does not select individual inference replicas hidden behind one provider gateway.

Distributed token-quota integration

Grid publishes routing state and the consumer configuration contract. Praxis AI owns request-time quota admission. The distributed quota integration supports:

• Basic Auth before quota reservation
• One identity-scoped Alice budget shared across consumer gateways
• Valkey-backed sliding-window state
• Atomic concurrent reservation safety
• Natural window expiry and recovery
• Quota persistence across consumer restarts
• Fail-closed admission during Valkey outage
• NetworkPolicy isolation for quota-client access

The distributed quota and Basic Auth integrations are experimental features. They are not included in the standard official Praxis AI 0.3.0 image, which supports provider selection and load balancing. To
evaluate these features, build a Praxis AI image from the AI repository with both token-rate-limit-filter and praxis-filter/basic-auth-filter enabled, then supply that image explicitly to the Grid deployment. Grid does not build or publish a Praxis AI rollup. The source-build and qualification procedure is documented in the token-quota topology README.

This release also includes pressure-aware admission and provider recovery, secure SWIM state validation, and AgentToolProvider support. Existing provider selection defaults remain compatible; deployments should review selection-policy defaults when upgrading existing GridNetworks.

Feature demonstrations

Praxis Grid Aware Token Rate Limiting Provider Routing

grid-quota-demo-v4-narrated.mp4

Praxis Grid Pressure Aware Routing and Provider Bursting

praxis-grid-cloud-burst.mp4

Container Images

ghcr.io/praxis-proxy/ai:0.3.0@sha256:ccd46f8772eebcbde2f41ad35c3234d23463b8314a5865083e32baf31eddd1a8
ghcr.io/praxis-proxy/grid-operator@sha256:8927163eef65ac7bdac8d39f960c735f0d26375ef7d6d999cd417f3a64437724
ghcr.io/praxis-proxy/grid-mock-providers@sha256:775791261b7ac0284797a84a277d95dea146d27d9b3d4786d165a96eb17c2758
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:a3cc31a8b5469dca63a0de406e342bfbbe46dee02fe33721d6bac1943748c711

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.1.4
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:fc72f7b58b2e2729f0a9da730e97a9b3b676f8aa74b0222724a764d1c1290d6c
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.1.4
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.1.4
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.1.4

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.1.4 \
  --namespace grid-system --create-namespace

The Grid images were built from 65b989d6e70e2b62d557987fd1cf3c6bc2ba4524. The Praxis AI image was verified from the organization-owned image above at praxis-proxy/ai@b44360afb4100c5543b1180ac8df16e482978fc8. Every reference above is immutable.

Distributed token quota image requirement

Grid publishes the routing topology and qualification for distributed token quotas, but the standard Praxis AI 0.3.0 container does not include the optional token-rate-limit-filter and praxis-filter/basic-auth-filter features. Deployments using the
quota example must supply a Praxis AI image built with both features. Grid does not publish a replacement AI rollup.

What's Changed

• fix(demo): correct broken deploy relative path in grid-glb-demo by @jordigilh in #39
• fix(operator): stop GridNetwork reconciler infinite hot-loop (grid#42) by @jordigilh in #45
• fix(xtask): restore make lint to green on main by @jordigilh in #50
• docs: clarify mock-epp/llmd-ext-proc image scope in operations.md by @jordigilh in #51
• feat(operator,crdt,swim): tenant-budget plumbing via SWIM-gossiped GCounter (grid#40) by @jordigilh in #47
• feat(demo): add --kv-cache flag to llm-d pool-metrics demo by @jordigilh in #46
• chore(lints): enable clippy redundant_clone, similar_names, unchecked_time_subtraction by @jordigilh in #55
• fix(ci): resolve triggered-integration-test base SHA live from refs/heads/main by @jordigilh in #62
• fix(crdt): cap distinct origin site-slots per tenant_spend counter by @jordigilh in #63
• fix(ci): stop trusting refs/pull/N/merge for triggered-integration-test by @jordigilh in #67
• fix(xtask): set GridNetwork gatewayRefs[].localSiteName in E2E fixtures by @jordigilh in #61
• fix(operator): distinguish SecretMissing from KeyMissing in TLS Secret resolution by @jordigilh in #59
• feat(operator): stabilized provider admission with scrape-generation identity by @nerdalert in #71
• fix(operator): validate gateway port by @hexfusion in #74
• fix(operator): stop advertised cert data removing a site from routing by @hexfusion in #81
• docs: fix README architecture diagram alignment by @nerdalert in #85
• fix: satisfy strict clippy lints by @nerdalert in #87
• test(swim): cover impersonation, tampering, and key rotation for signed state broadcasts by @jordigilh in #99
• feat(routing): publish provider selection modes by @nerdalert in #65
• feat(token-quota): add distributed quota topology by @nerdalert in #84
• test: add a validation for single-cluster multi-gateway routing by @nerdalert in #117
• chore(release): prepare Grid v0.1.4 by @nerdalert in #115

New Contributors

• @hexfusion made their first contribution in #74 🎉

Full Changelog: v0.1.3...v0.1.4

Grid v0.1.3

Grid v0.1.3 changes

• Added separate health and TLS endpoints for Kubernetes health checks.
• Added selectable provider scoring strategies: noMetrics, queueDepth, and kvCachePressure.
• The noMetrics default disables dynamic metric preference while retaining health and routing policies.
• Improved VCR pressure-routing demo and metrics handling.
• Added registry-backed metrics demo support.
• Added maintainer-triggered PR E2E workflows with quick/full modes.
• Improved llm-d image loading and optional metrics transport.
• Published official Grid v0.1.3 operator, overlay-sync, mock-provider, AI rollup images, and Helm charts.

Container Images

ghcr.io/praxis-proxy/grid-ai-rollup:v0.1.3@sha256:e5bdea9071f76533ab61714eeef6067c7449d0e9d811c221aa940cf3cdf9719f
ghcr.io/praxis-proxy/grid-operator@sha256:c213128e6f70f528e7238b695f2993ffe4224eac38dc893161423e3feee53f35
ghcr.io/praxis-proxy/grid-mock-providers@sha256:e0ab1e839f07af0c6bb170a7653079cf7c96f91f10ceadabd9af669ce72f1fef
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:b90169e98593597b445e26eacaf5a08a79254c91134f4b9161002da5331f463c

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.1.3
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:6eb4575b0a15be75c6fc26e3db23a76f3a8a685b6cb54350a853bf72ce3b79b1
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.1.3
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.1.3
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.1.3

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.1.3 \
  --namespace grid-system --create-namespace

The Grid images were built from 068c68958456ad8bcba08d651213a3d8566a4c30. The Praxis AI
rollup was built from
praxis-proxy/ai@c68149502d991d51daaff8d6bf96c18704aeb38d and
praxis-proxy/praxis@0d3347c634ab4e09d882c02bf01767a1667c82db.
Every reference above is immutable.

What's Changed

• feat: separate endpoint and tls support for healthchecks by @mvazquezc in #29

New Contributors

• @mvazquezc made their first contribution in #29

Full Changelog: v0.1.2...v0.1.3

Grid v0.1.2

Container Images

ghcr.io/praxis-proxy/grid-ai-rollup@sha256:95132eb39c0f568b5361a250002979c5063db427ff0fb63b59a93146fcb7ad31
ghcr.io/praxis-proxy/grid-operator@sha256:578e26129d1b281e664b5261b345b76cd38844a58a400adc48f3d7d9c58518e5
ghcr.io/praxis-proxy/grid-mock-providers@sha256:70315c3aa58747b92d5e3d6c8406d13606a93c486c78d0cd6eaf655be2ede7bf
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:2e42bce30673c2363157495ff72c12fe5669159382a102de0d0df7459939018c

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.1.2
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:d2c3cea00a609c88872dc17fb3de2d89973399ffa45c6d7b7aebeb2e5046685e
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.1.2
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.1.2
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.1.2

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.1.2 \
  --namespace grid-system --create-namespace

The Grid images were built from f17b2fc6ee9433fd23096164d6c308cbded3b995. The Praxis AI
rollup was built from
praxis-proxy/ai@7341b2d593f9aaafee6b8c3e1be75a2c6ea4108e and
praxis-proxy/praxis@e6001bad6fc42fde26cecca4682f04ddedc57abf.
Every reference above is immutable.

What's Changed

• feat(demo): add MaaS IPP Kind lab by @aslakknutsen in #22

New Contributors

• @aslakknutsen made their first contribution in #22

Full Changelog: v0.1.1...v0.1.2

Grid v0.1.1

Highlights

• Adds the production Helm workflow for adding, removing, and restoring inference providers.
• Documents in-cluster, existing-Service, and external HTTPS provider integration.
• Adds provider workflow, multi-provider, NetworkPolicy, values-precedence, and removal validation.
• Completes the runnable three-site combined-site demonstration.
• Proves local preference, remote fallback, session behavior, provider add/remove/re-add, deterministic identity, overlay convergence, security boundaries, operator recovery, and cleanup.
• Pins the Getting Started demo to the compatible project-owned image digests.

Temporary Praxis AI and Praxis Core Forks

Grid v0.1.1 temporarily builds the grid-ai-rollup image from development revisions of Praxis AI and Praxis Core. The required Grid integration changes have not all reached compatible upstream releases, so building from released upstream versions would omit functionality exercised by the Grid demos and Helm deployments.

The rollup remains a single gateway image. It does not require separate Praxis AI and Praxis Core containers. The forks are source dependencies used to produce that combined image until the changes are merged and released upstream.

Required Praxis AI Features

• Grid-aware intelligent provider selection from operator-generated routing overlays.
• Versioned overlay validation and hot reload with last-known-good retention.
• Provider-hop routing context and serving-revision attribution.
• Provider-boundary authorization for exact candidate, model, path, and cluster mappings.
• Final-hop provider credential injection and caller authorization replacement.
• Session affinity across local selection, remote fallback, and restoration.
• Optional external HTTPS provider routing, including OpenAI.

Required Praxis Core Features

• Per-cluster HTTP authority override for external HTTPS providers.
• Independent TLS SNI and HTTP authority configuration.
• mTLS client-certificate enforcement.
• Peer identity and trust-policy enforcement.
• Load-balancer behavior required by consumer-to-provider and provider-to-backend routing.
• Runtime and configuration support used by the Praxis AI Grid filters.

The temporary source revisions are:

praxis-proxy/ai@7341b2d
praxis-proxy/praxis@e6001ba

These forks should be retired once equivalent Praxis AI and Praxis Core changes are merged, released, and validated together. The immutable grid-ai-rollup digest records the exact compatible implementation used by Grid v0.1.1.

Runnable Grid Demonstrations

Grid now includes automated, evidence-backed demonstrations for its primary deployment topologies. See the Grid demos page (https://github.com/praxis-proxy/grid/tree/main/demos) for prerequisites, topology diagrams, commands, and validation details.

• Global Ingress: Demonstrates external traffic entering through healthy edge gateways before Grid selects an eligible provider.

• Workload Inference: Demonstrates cluster-local workloads using consumer gateways with dedicated provider clusters, local preference, and remote fallback.

• Combined Sites: Demonstrates three clusters that each run separate consumer and provider gateways, including local preference, cross-site fallback, session behavior, provider add/remove/ re-add, overlay convergence, security enforcement, recovery, and cleanup.

• Optional external providers: Supports opt-in live OpenAI routing while keeping credentials isolated to the selected provider gateway.

• Automated runtime proof: Demo assertions validate mTLS, peer authorization, credential replacement, backend isolation, routing attribution, provider lifecycle, stable identity, operator recovery, and sanitized evidence.

Container Images

ghcr.io/praxis-proxy/grid-ai-rollup@sha256:95132eb39c0f568b5361a250002979c5063db427ff0fb63b59a93146fcb7ad31
ghcr.io/praxis-proxy/grid-operator@sha256:654d9079e13c80e7891dcdd2eed52901ebd733833ae02d776a69a4170c00d9bb
ghcr.io/praxis-proxy/grid-mock-providers@sha256:60c9ac29782b2ce6c99eb4d82494bd10280ef06b453752486f6933927547d333

Helm Charts

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.1.1
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:2c5ecf8d23846aeb403616e6501b72be872a8f59006536af9f87cad7a409ed7e
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.1.1
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.1.1
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.1.1

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.1.1 \
  --namespace grid-system --create-namespace

Full Changelog: v0.1.0...v0.1.1

Grid v0.1.0

Grid v0.1.0

Grid v0.1.0 provides the first reproducible implementation of distributed, multi-cluster inference routing for Praxis.

Functionality

• Kubernetes operators and CRDs for defining Grid networks and sites.
• Decentralized site discovery and partition-tolerant state propagation.
• Active/active Praxis edge gateways behind a stable ingress endpoint.
• Multiple independently selectable providers within a site.
• Health, capacity, locality, freshness, and admission-aware routing.
• Session affinity with provider drain behavior.
• Provider and edge failure detection, withdrawal, and recovery.
• mTLS site trust, provider authorization, and credential isolation.
• Versioned routing overlays with observable revision propagation.
• Hot configuration reload without restarting the Praxis edge.
• Last-known-good routing when an invalid overlay is received.
• Machine-readable evidence for routing, security, restart, and soak tests.

Demo

The Grid global ingress demo (https://github.com/praxis-proxy/grid/tree/v0.1.0/demos/grid-glb-demo) provides a reproducible local environment using Kubernetes-in-Docker clusters.

The demo validates the following functionality through live runtime assertions:

• Site discovery
• Routing-overlay propagation
• Active/active edge routing
• Multiple providers per site
• Secure provider boundaries
• Session affinity
• Provider drain
• Edge withdrawal and recovery
• Grid restart recovery
• Invalid-overlay protection
• Sustained traffic validation

Praxis AI Dependency

The demo currently uses a temporary Grid-specific fork and rollup of Praxis AI. It combines functionality from open Praxis AI changes that have not yet landed in a standard Praxis AI release:

• Intelligent Grid routing (praxis-proxy/ai#339)
• Routing-overlay hot reload and observable envelope (praxis-proxy/ai#540)
• Secure provider-routing boundary (praxis-proxy/ai#386)

The rollup is published separately as ghcr.io/praxis-proxy/grid-ai-rollup and pinned by immutable digest in the demo documentation. It is intended for integration and demonstration until the underlying changes are reviewed, merged, and included in an upstream Praxis AI release.

Known Limitations

• The included topology models multiple clusters within one region.
• Global ingress uses a local GTM emulator; production DNS or Route 53 integration is not included.
• Mock inference providers are for demonstration and validation only.
• Cross-region routing, regional affinity and locking, and direct public-cloud provider routing remain outside this release.