RaySpec v1.6.2

Added

• Static frontends can ship a custom 404.html. When a request to a mounted
  static frontend misses (no file, no dir/index.html, and no SPA fallback) and
  the mount's root contains a 404.html, that file is served with HTTP status 404
  and Content-Type: text/html — the GitHub Pages / Netlify / Cloudflare Pages
  convention. Fully backward compatible: without the file, the platform's uniform
  404 is unchanged. The custom page is served only on a genuine content miss —
  reserved platform prefixes (/v1, /health, /oidc) and refused paths
  (traversal, dotfiles, symlink escapes) keep the uniform 404, and on an spa:true
  mount the SPA index.html fallback still wins.

Changed

• Boot secrets are whitespace-trimmed uniformly, whatever their source. Leading
  and trailing whitespace — a trailing newline and a leading byte-order mark
  included — is now stripped from every resolved boot secret (DATABASE_URL,
  RAYSPEC_JWT_SIGNING_KEY, RAYSPEC_API_KEY_PEPPER) whether it is read from a
  <VAR>_FILE mount or from the plain variable, giving the two sources one
  documented contract instead of source-dependent behavior. Interior bytes are never
  touched, so a multi-line PEM keeps its internal newlines and its header at offset 0.

  ⚠ Migration note. The one behavioral change is on the plain variable, and it
  matters because RAYSPEC_API_KEY_PEPPER is the HMAC key for api-key, session, and
  invite hashes. A deployment whose plain RAYSPEC_API_KEY_PEPPER currently carries
  significant edge whitespace must strip it before upgrading — already-issued keys
  and sessions were hashed under the untrimmed value and would otherwise stop
  verifying. For every well-formed secret (a base64 pepper, an RS256 PEM) this is a
  no-op. The one contract limit: a secret whose real bytes must begin or end with
  whitespace cannot be expressed through a boot variable — encode such a value (for
  example, base64).

• journal_steps gains a created_at index. Additive migration 0009 adds a
  btree index (journal_steps_created_at_idx) on journal_steps(created_at), so
  time-range and day-bucket scans over the step journal are index-backed instead of
  sequential — paralleling the existing runs_created_at_idx on the run header. The
  change is non-destructive; drizzle-kit migrate builds the index on the existing
  table (a plain, non-CONCURRENTLY build that briefly locks writes for its duration).

Security

• Transitive postcss pinned to 8.5.18 (GHSA-r28c-9q8g-f849). A pnpm override
  raises the transitive postcss — pulled only by the vite/vitest development
  toolchain, never a runtime dependency — to the patched 8.5.18, clearing a source-map
  (sourceMappingURL) path-traversal advisory flagged by the dependency audit. Build-
  and test-time only: no runtime code path is affected and no published package's
  contents change.

---

Licensing. This release is distributed under FSL-1.1-ALv2 and converts to the
Apache License 2.0 on 2028-07-24 (the second anniversary of this release).

npm. The 1.6.2 npm packages follow shortly.