v1.5.0 — SDK Parity + Dependency Visualization

Added

• SDK Parity: Java, Ruby, and .NET SDKs brought to full 5-step evaluation pipeline parity with TypeScript/Python — prerequisites (recursive dependency evaluation with cycle detection + memoization, gate soft/hard semantics), individual target-list matching, priority-sorted rule matching (eq/neq/in/nin/contains/startswith/endswith/gt/gte/lt/lte/semver_/date_ operators, case-insensitive geo attributes, per-rule rollout sub-bucketing), and hashVersion=2 FNV-1a fallthrough hashing alongside the existing MurmurHash3 v1. docs/SDK_CONTRACT.md rewritten from an observational feature matrix into a normative canonical spec that all three SDKs implement. packages/sdks/test-contract/vectors.json expanded from v1.1 (24 hash-only vectors) to v1.2 (adds prerequisite, rule, and missing-attribute vectors) as the executable definition of parity (#94).
• Java SDK (packages/sdks/flagmind-java/): added FlagPrerequisite, TargetingRule, PropertyCondition types, hashVersion field on FlagEnvironmentState, PrerequisiteChecker, RuleMatcher, InconclusiveMatchException. Maven artifactId standardized to tombstone-java-sdk (was flagmind-java). ContractVectorsTest harness verified locally: 89/89 tests pass (BUILD SUCCESSFUL), also green in CI (#97).
• Ruby SDK (packages/sdks/flagmind-ruby/): same 5-step pipeline additions as Java. Gem name standardized to tombstone-ruby-sdk (was flagmind-ruby). contract_vectors_spec.rb harness: 60 examples, 0 failures — verified both locally and in CI (#98).
• .NET SDK (packages/sdks/flagmind-dotnet/): same 5-step pipeline additions as Java/Ruby, implemented by hand — no dotnet/csc/mono toolchain was available in the authoring environment, so this SDK's dotnet test run has not been executed by any human or CI yet (no .NET job exists in .github/workflows/ci.yml). Reviewed line-by-line against the canonical spec and the existing codebase's conventions; a dotnet test run on a machine with the .NET 8 SDK is required before this SDK's parity claim is fully verified (#99).
• Dependency Visualization (services/intelligence/): new REST endpoints GET /api/v1/graph/dependencies (wraps DependencyGraphBuilder.get_impact_fast(), Redis-backed with DB-scan fallback) and GET /api/v1/graph/critical-flags (Dependency Health Score ranking: score = (in_degree + out_degree) * avg_edge_weight * blast_radius_multiplier, multiplier 4/3/2/1 for BLOCKED/HIGH/MEDIUM/LOW). New MCP tool tombstone_get_dependency_graph (workspace-mcp/src/tools/flags.ts). Dashboard gains a "Dependencies" tab (DependenciesTab.tsx) with a force-directed graph (DependencyGraph.tsx, d3-force) and a CriticalFlagsPanel.tsx sorted list linking into flag detail pages. Python and Vitest test suites added for both endpoints and both new components (#95).

Fixed

• Ruby SDK P0: removed the broken lib/flagmind.rb entrypoint, which require_relative'd files that referenced a nonexistent Flagmind module — this SDK could not be required at all before this fix. lib/tombstone.rb is now the correct, working entrypoint (#98).
• .NET SDK P0: tests/FlagMind.Tests/FlagMind.Tests.csproj's ProjectReference pointed at src/Tombstone/Tombstone.csproj, which does not exist — corrected to the real src/FlagMind/FlagMind.csproj path. This SDK's test project could not build at all before this fix (#99).
• CI: pinned ruff to 0.15.9 in .github/workflows/ci.yml's Python Intelligence Service job — an unpinned pip install ruff had silently resolved 0.16.1 mid-release, whose expanded default ruleset (import-sorting, blind-except, and others) flagged 88 pre-existing violations unrelated to any in-flight PR's diff (#96).

Known issues (pre-existing, not introduced by this release)

• workspace-dashboard's Cloudflare Pages and Vercel deploy workflows have been failing since 2026-07-07 (confirmed via GitHub Actions history, reproduced locally) due to workspace-dashboard/package-lock.json drifting out of sync with package.json — npm ci reports several packages "Missing from lock file". This predates v1.5.0 and both Track A (SDK parity) and Track B (dependency visualization) work; it is not a regression from this release. Needs a separate package-lock.json regeneration fix.

v1.4.4

Fixed

• Argo CD notifications duplicate-resource fix: the vendored install manifest ships empty stub ConfigMap/Secret resources for argocd-notifications-cm / argocd-notifications-secret. Kustomize does not dedupe resources pulled in from independent sub-bases, so these stubs collided with the real ones. Added a $patch: delete inside core/'s own kustomization.yaml to remove the stub resources without modifying the vendor file.

Changelog

Full details: CHANGELOG.md on main

v1.4.3

Fixed

• Python SDK: added the gate soft-prerequisite field to _check_prerequisites, matching TypeScript's semantics — gate: false on an unmet prerequisite now skips and continues evaluation instead of always blocking. Removed the dead duplicate flagmind/ package (never published in any tombstone-sdk wheel).
• Java SDK: fixed the io.flagmind/io.tombstone package-directory mismatch that had silently excluded src/main from git since the initial commit. Renamed FlagMindClient.java to TombstoneClient.java to match its public class name, and corrected an okhttp3 import. The Java SDK now actually compiles and passes its test suite in CI for the first time.
• GitOps: fixed gitops/providers/argocd/ and gitops/providers/both/ referencing a Kustomize resource file that never existed — every argocd-bootstrap.yml run had failed before reaching cluster connectivity. Restructured both clusters' Argo CD manifests into composable sub-bases, closing a gap where providers/both/ was missing the Argo Rollouts CRD installer and Lua health-check ConfigMap patches.
• GitOps: argocd-bootstrap.yml's cluster input was set but never used in the apply path — every run applied production's Argo CD Applications regardless of the selected cluster. Fixed with cluster-aware provider overlays.
• GitOps: reconciled a genuine divergence between develop and main — a missing argocd Namespace manifest on production, and a stale Flux ImageUpdateAutomation API version.

Added

• docs/SDK_CONTRACT.md: a feature-parity matrix across all 5 SDKs, built by reading each language's actual evaluation source. Corrects an inflated "full parity" claim in docs/SDK_INTEGRATION_GUIDE.md — only TypeScript and Python implement the full 5-step evaluation pipeline; Java, Ruby, and .NET implement only steps 1 and 5.

SDK versions

• tombstone-sdk (Python) 0.2.1
• flagmind-java 0.1.1

Full changelog: https://github.com/sairam0424/Tombstone/blob/main/CHANGELOG.md

Tombstone v1.4.2 — GitOps DevOps upgrade + Python SDK full TypeScript parity

What's New in v1.4.2

GitOps DevOps Upgrade

• Flux CD v2.3+ + Argo CD v2.11 dual-controller GitOps with gitops/providers/flux|argocd|both/ provider selection
• Argo Rollouts v1.7 — tombstone-blast-radius AnalysisTemplate canary gate via evaluator blast-radius endpoint
• tombstone-operator Helm chart v0.1.0 published to ghcr.io/sairam0424/charts
• Bootstrap: flux-bootstrap.yml → argocd-bootstrap.yml — fully automated cluster setup
• All 13 workflow files SHA-pinned (0 floating @v tags)

Python SDK v0.2.1 — Full TypeScript Parity

pip install tombstone-sdk==0.2.1

• hashVersion=2 FNV-1a double-pass — exact match to TypeScript: fnv(str(fnv(key+userId))) % 10000 / 10000 < rollout/100
• Step 3 TARGET_MATCH — explicit user target list membership
• Rule priority sort — ascending before evaluation
• Circular prerequisite cycle guard via seen_keys set
• Uppercase operator normalization — EQ/PREFIX/SUFFIX wire-format operators now work
• hash_version + target_list deserialized from server snapshots and SSE events
• 66 tests green

CI/CD Fixed

• Removed || true masking from all SDK and intelligence test steps — real failures now surface
• Fixed 4 pre-existing hidden test failures: pytest install, ruff unused vars, Ruby require path, Java Gradle version

Upgrade

See docs/OKE_RUNBOOK.md for K8s cluster provisioning.

Backlog (next release)

• Oracle Cloud OKE staging cluster
• Java SDK package/directory mismatch fix
• Python SDK gate field for soft prerequisites

v1.4.1

Tombstone v1.4.1 — Argo CD v2.11 GitOps provider, dynamic flux|argocd…

v1.3.0

Tombstone v1.3.0 — Helm chart v0.2.0 (full K8s coverage), Python SDK …

Tombstone v1.2.1 — Critical Regression Fixes

Patch release
fixing 5 critical regressions found by adversarial pre-release testing. See CHANGELOG.md.

v1.2.0

Tombstone v1.2.0 — production resilience layer

Tombstone v1.2.0 — Production Resilience Layer

10-phase resilience initiative:
retry+jitter+circuit-breaker on all inter-service calls, distributed rate limiting, adaptive load shedding, idempotency keys
(actor-scoped), Redis Streams DLQ, scheduler FOR UPDATE SKIP LOCKED, snapshot reconciliation, webhook dedup, asyncio hardening,
and 4 audit-confirmed fixes (Merkle hash, SEC-001, SEC-002, asyncio deprecation). See CHANGELOG.md for full details.

Tombstone v1.0.0 — Self-Hosted

Tombstone v1.0.0 — Self-Hosted Release

Full production intelligence platform. Runs locally with one command.

Quick Start

Prerequisites: Docker 20.10+, Docker Compose v2+, Make

git clone https://github.com/sairam0424/Tombstone.git
cd Tombstone
cp infra/.env.example infra/.env
make dev

Dashboard at http://localhost:3000 — all services running, all views functional.

Services

• flag-api :8081 — Flag CRUD, approvals, audit log, kill switch
• gateway :8080 — SSE streaming to SDKs
• evaluator :8082 — Blast-radius, circuit-breaker, SLO
• intelligence :8083 — Anomaly detection, recommendations
• dashboard :3000 — React 19 management UI
• gitops-sync :8084, ast-rewriter :8085, marketplace :8086

v1.1 Roadmap

• Cloud-hosted option (Northflank + Vercel)
• Kubernetes Helm charts

Docs updated.