Grid v0.2.0

Container Images

ghcr.io/praxis-proxy/ai:0.4.0@sha256:0f619d4a0b533093f94a76921cfbba0ecdec51557dffee1615a29721ee1fc878
ghcr.io/praxis-proxy/grid-operator@sha256:9ae617ed04d93521860b1efeab8cd7ed39801bb79a6217d55678a11431147fbc
ghcr.io/praxis-proxy/grid-gateway@sha256:3b6679e885fb9a4ef9fa8b8fb7214de36648e649cbb80722a296b87ea1ce9f42
ghcr.io/praxis-proxy/grid-mock-providers@sha256:888bf04a00f6366427ae87f6178a9023509056d2305bc72b93ed0c8919d84fdf
ghcr.io/praxis-proxy/grid-enrollment@sha256:9d73ea9dee05a5e5d09437f05b42a903c867341a28c22f6e053e142693118170
ghcr.io/praxis-proxy/grid-overlay-sync@sha256:897bbd5e97e413ce174966a5812e71f0f2a9cb96346fca49faf8eaa46dc1ae54

Helm Chart

oci://ghcr.io/praxis-proxy/charts/grid-operator --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-operator@sha256:a541abbaab220fd63e2eac2cbad367996b82c837f26bb0370e6fbfec3713746b
oci://ghcr.io/praxis-proxy/charts/praxis-gateway --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-site --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-mock-providers --version 0.2.0
oci://ghcr.io/praxis-proxy/charts/grid-enrollment --version 0.2.0

Install:

helm install grid-operator \
  oci://ghcr.io/praxis-proxy/charts/grid-operator \
  --version 0.2.0 \
  --namespace grid-system --create-namespace

The Grid images were built from a4a7d7168ec36e59f31bcb9be0d11d6dd69c4974. The Praxis AI
image was verified from the organization-owned image above at
praxis-proxy/ai@ca3e760c790a34293c03d2314a3c7cfbf73836b3.
Every reference above is immutable.

Distributed token quota image requirement

Grid publishes the routing topology and qualification for distributed
token quotas, but the standard Praxis AI 0.4.0
container does not include the optional token-rate-limit-filter
feature. Basic Auth is present, but deployments using the quota example
must supply a Praxis AI image built with the token-rate-limit filter.
Grid does not publish a replacement AI rollup.

What's Changed

• ci: remove isolated GLB release check by @nerdalert in #118
• test(quota): wait for serving overlay revision by @nerdalert in #120
• test(glb): harden provider withdrawal qualification by @nerdalert in #121
• test(llmd): make pressure qualification deterministic by @nerdalert in #122
• test(quota): isolate qualification runs by @nerdalert in #123
• fix(quota): isolate Forge runtime state by @nerdalert in #124
• test(glb): make drain and attribution proofs strict by @nerdalert in #125
• build(deps): bump the cargo-minor-patch group with 2 updates by @dependabot[bot] in #128
• build(deps): align kube with k8s-openapi 0.28 by @nerdalert in #129
• build(deps): upgrade aes-gcm to 0.11.1 by @nerdalert in #130
• feat(swim): resolve DNS endpoint hostnames by @nerdalert in #138
• feat(operator): add administrative provider drain by @nerdalert in #126
• feat(routing): add static weighted provider selection by @nerdalert in #142
• feat(operator): cross-site provider signals via a grid-wide signalTransport by @hexfusion in #147
• build(deps): bump the cargo-minor-patch group with 4 updates by @dependabot[bot] in #149
• feat(enrollment): standalone single-use site-token enrollment service by @hexfusion in #153
• fix(operator): guard GridSite status writes on controller-owned fields only by @hexfusion in #157
• feat(operator): opt-in FIPS OpenSSL TLS backend by @hexfusion in #148
• build(images): standardize Containerfiles on whole-workspace multi-stage builds by @hexfusion in #161
• feat(gateway): stub the praxis-grid-gateway operand by @hexfusion in #159
• build(deps): bump the cargo-minor-patch group with 3 updates by @dependabot[bot] in #182
• build(deps): bump sqlx from 0.8.6 to 0.9.0 by @nerdalert in #185
• build(deps): bump schemars from 0.8.22 to 1.2.2 by @nerdalert in #186
• fix(certs): run certificate keygen and hashing on the FIPS module by @hexfusion in #173
• docs: consolidate provider routing docs by @nerdalert in #188
• docs: clarify Grid gateway release contract by @nerdalert in #190
• chore(release): qualify main integration topologies by @nerdalert in #178
• Split the grid-gateway into its own workspace and bump praxis-proxy to 0.7 by @hexfusion in #194
• feat(enrollment): grid enrollment, issuance, SPIFFE verifier, chart, and e2e by @hexfusion in #201
• feat(grid): cross-site load routing over verified mTLS by @hexfusion in #203
• build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #206
• build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #207
• fix(enrollment): fail loudly on bootstrap misconfig instead of a bare NotPresent by @hexfusion in #209
• docs: adopt AI Grid Network branding by @nerdalert in #205
• build(deps): bump rmcp and related libraries by @nerdalert in #212
• chore(CRD): add shortnames to the Grid CRDs by @zdtsw in #213
• feat(deploy): add a kustomization for the CRDs by @hexfusion in #215
• fix(charts): allow enabled and global so operator and gateway work as subcharts by @hexfusion in #217
• render the gateway config from the chart with secure defaults by @hexfusion in #210
• feat(grid-enrollment): pin images by digest by @hexfusion in #225
• fix(charts): grid chart and enrollment fixes by @hexfusion in #229
• fix(CRD): correct generated manifests from the Rust types by @zdtsw in #214
• feat: operator auto-enroll from hub site invites by @hexfusion in #234
• feat(operator): SWIM across clusters and signals peer trust by @hexfusion in #237
• fix(scripts): read verification model from candidate name by @derekhiggins in #243
• fix(chart): pin the overlay-sync sidecar image tag to v0.1.4 by @zdtsw in #244
• feat(operator): poll providers for served models by @evacchi in #191
• feat(charts): install an enrolled hub and sites with helm by @hexfusion in #239
• ci: build each image once per commit and cache Rust deps per job by @hexfusion in #252
• fix(forge): treat podman's network inspect output as Docker's by @hexfusion in #253
• ci: test charts at the Helm 3.12 floor and add a chart upgrade e2e by @hexfusion in #242
• Chore: general fixes and cleanup for helm charts by @shaneutt in #255
• fix(operator): stop the GridNetwork status reconcile loop by @hexfusion in #249
• fix(gateway): initialize tracing so the gateway logs by @hexfusion in #250
• fix(operator): trust auto-discovered peers under spiffe peer trust by @hexfusion in #269
• fix(operator): two-site grid fixes by @hexfusion in #263
• feat(api): move the grid API group to grid.praxis.fast by @hexfusion in #257
• feat(gateway): apply serving config and identity changes without a restart by @hexfusion in #259
• feat(operator): join a grid from a single operator install by @hexfusion in #261
• fix(signals-client): poll peers through the process crypto provider by @hexfusion in #276
• charts and CI: log level, gateway probes, PVC annotations, workspace gates, and flake fixes by @hexfusion in #277
• feat(operator): metrics over TLS, authenticated EPP scraping, quieter logs, stub collection, and a site phase metric by @hexfusion in #278
• fix(ci): preload pinned images for triggered GLB E2E by @nerdalert in #280
• fix(gateway): stop the serving watcher applying one identity rotation twice by @hexfusion in #283
• chore(gateway): bump praxis to 0.7.3 and praxis-ai to 0.5.0 by @hexfusion in #282
• feat(praxis-gateway): reencrypt to a service-ca listener cert without a destination CA by @hexfusion in #264
• test(e2e): run triggered GLB from Grid topology by @nerdalert in #285
• build(deps): bump the cargo-minor-patch group with 3 updates by @dependabot[bot] in #299
• ci: schedule nightly GLB e2e run by @nerdalert in #295
• chore(make): include Gateway checks in root lint by @nerdalert in #296
• feat(observability): configure opt-in OpenTelemetry export by @nerdalert in #271
• fix(operator): serve signals on their own Service by @hexfusion in #300
• feat(fleet-dashboard): add the opt-in hub fleet dashboard by @szedan-rh in #279
• feat: wire AgentToolProvider into SWIM/CRDT broadcast and routing overlay by @liavweiss in #189
• docs(tp-scope): clarify Grid technical preview limits by @nerdalert in #284
• feat(gateway): prefix affinity, keep a conversation on the site holding its prompt by @hexfusion in #287
• chore(release): prepare Grid v0.1.5 by @nerdalert in #193
• fix: correct placement policy rendering and gateway discovery examples by @zdtsw in #245
• refactor(operator): share TLS configuration across provider checks by @evacchi in #298
• feat(chart): fail the gateway install quick when praxis.yaml ConfigMap is missing by @zdtsw in #216
• fix(operator): mint the metrics scraper token unbound by @hexfusion in #288
• fix: refresh both lockfiles for the 0.1.5 version bump by @hexfusion in #306
• feat(certs): name the site in its certificate organization by @hexfusion in #305
• feat: give every binary a build identity, logged at startup by @hexfusion in #317
• feat(gateway): measured site availability for site selection and shedding by @hexfusion in #319
• fix(operator): authenticate inference provider health probes by @evacchi in #265
• feat(operator): reconcile consumer gateway Secret mounts by @nerdalert in #272
• feat(chart): expose the peer signal poll interval by @hexfusion in #309
• fix(praxis-gateway): let the metrics ServiceMonitor set a scrape timeout by @hexfusion in #290
• chore(release): prepare Grid v0.2.0 by @hexfusion in #322

New Contributors

• @zdtsw made their first contribution in #213
• @derekhiggins made their first contribution in #243
• @evacchi made their first contribution in #191
• @shaneutt made their first contribution in #255
• @szedan-rh made their first contribution in #279
• @liavweiss made their first contribution in #189

Full Changelog: v0.1.4...v0.2.0