v0.2.1

Container images

All published to ghcr.io/soctalk and tagged 0.2.1, <short-sha>, and latest.

• ghcr.io/soctalk/soctalk-api:0.2.1
• ghcr.io/soctalk/soctalk-app-ui:0.2.1
• ghcr.io/soctalk/soctalk-adapter:0.2.1
• ghcr.io/soctalk/soctalk-orchestrator:0.2.1
• ghcr.io/soctalk/soctalk-linux-ep:0.2.1

Helm charts (OCI)

Pulled via helm pull oci://ghcr.io/soctalk/charts/<chart> --version <ver>.

• oci://ghcr.io/soctalk/charts/soctalk-system @ 0.2.1
• oci://ghcr.io/soctalk/charts/soctalk-tenant @ 0.2.1
• oci://ghcr.io/soctalk/charts/wazuh @ 0.2.1
• oci://ghcr.io/soctalk/charts/linux-ep @ 0.2.1

OS packages

Attached below: soctalk-<ver>.rpm (dnf/yum) and .deb (apt).
Install: e.g. sudo dnf install ./soctalk-0.2.1.rpm && sudo soctalk install.
Alpine is not supported (soctalk install needs systemd); use the VM appliance.

Demo VM images (qcow2/vmdk/ova/…) build automatically and attach here when ready.

Changes since v0.2.0

• fix(provisioning): evaluate the tenant image-tag fallback lazily (df31620)
• fix(provisioning): tenant images must not default to latest (hard rule 10) (58f56b0)
• docs(release): reconcile #147 as fixed, link #148 for package checksums (49aab36)
• docs(release): log the 5a4faa9 re-cut (BYO SIEM port derivation) (6875d6b)
• fix(byo-wazuh): derive the external SIEM egress ports from the tenant URLs (#147) (5a4faa9)
• docs(byo-wazuh): correct the record - BYO Wazuh works (c33874b)
• docs(byo-wazuh): document what 0.2.1 really needs for an external Wazuh (8c136af)
• docs(release): row 5 passes on the 7e4dcac re-cut (pinning fixed) (699d29d)
• docs(release): scoped re-cuts are allowed, but the log must show the scope (075b530)
• fix(release): no shipped artifact may consume the latest tag (hard rule 10) (7e4dcac)
• docs(release): hard rule 10 - nothing shipped may consume latest (6432a5f)
• docs(release): capture the matrix-run process — appliance/package recipes, launchpad CLI, and the traps that cost time (6f3f7b2)
• docs(release): row 3 (launchpad L2) passes on 85da7dc; rows 1-4 green (71f9629)
• docs(release): record the 85da7dc matrix run (rows 1,2,4 pass; 3 blocked; 5-6 not validated) (b710b7a)
• docs(chart): a no-TLS lab install makes the origin http, and CSRF enforces it (f4cfeeb)
• fix(gate): refuse to report success from an inspection that saw nothing (2dbba14)
• docs(release): a re-cut must re-run every install mechanism (4fd44f0)
• fix(release): report 0.2.1, and document the real charts-only recipe (85da7dc)
• docs(release): versioning policy — re-cut 0.2.1, never bump; #146 lands on a re-cut (659342b)
• docs(release): #145 closed (k3s enforces NP); hook-broadening tracked as #146 (5fec288)
• docs(cni): correct the 'k3s can't enforce NetworkPolicy' claim; charts-only guidance (2b76ded)
• docs(release): launchpad image-cache false-hit fixed (soctalk-launchpad#1) (13c4396)
• docs(release): state the immutability discipline — roll forward, never patch in place (d25806b)
• docs(release): correct handoff prompt per Codex review; gate all 5 images (0a10b74)
• chore(release): refer to hosts by role (staging), not the NUC machine (8235a90)
• docs(release): generalize hosts to roles in the handoff prompt (9de2427)
• docs(release): recast the release doc as an LLM handoff system prompt (ed7d72f)
• docs(release): bring the release doc current — validation gates + release log (3c9ed56)
• install: normalize provider aliases + skip LLM validation in values-file mode (f29c5f8)
• docs: record the release workflow (publish/cut/deploy paths, install, launchpad) (3adb7c5)
• fix(worker): runs-worker honors SOCTALK_API_VERIFY_SSL on the L1 client (9a2a2dd)
• install: require an LLM model for openai-compatible/self-hosted (#142) (90b576c)
• demo: give the MSSP surface its own hostname (mssp.soctalk.ai) (2e097ba)
• fix(frontend): clearing the LLM base URL gets a designed error (#142) (8dc7661)
• fix(frontend): audience-wall the MSSP policy/playbook pages (#143, #144) (1e4a5fc)
• test(e2e): pricing/budget subsystem end to end against a live stack (#142) (acb97ae)
• fix(pricing): price suggestions use the effective engine (#142) (85921ec)
• fix(pricing): stale engines stay inert at PATCH and tier render (#142) (bba3378)
• fix(pricing): one effective engine, one hosted-authority table (#142) (6326076)
• fix(pricing): upgrade-safe rows, label-bound vendors, UI key parity (#142) (0bee162)
• fix(pricing): fold unicode dots like httpx, and fix BYOK reads (#142) (c4f36fb)
• fix(chart): hosted-URL schema guards match hostnames case-insensitively (#142) (97e6b2b)
• fix(pricing): one hosted-URL definition, tiers included (#142) (b6f67f5)
• fix(chart): the system chart obeys the served-engine invariant too (#142) (856bfb0)
• fix(pricing): served engines require a usable primary base URL (#142) (2659649)
• chore: sync uv.lock with the 0.2.1 version bump (80cf34f)
• fix(pricing): carry the primary engine end to end (#142) (d2ea207)
• fix(pricing): validate the primary engine, and let a tenant clear it (#142) (2e11c94)
• fix(pricing): give the primary tenant config a serving engine (#142) (b4b629f)
• fix(chart): seed tenants the same coherent LLM config the pod runs (#142) (fa7e9d4)
• fix(chart): trim baseUrl before validating it (#142) (ab3ca15)
• fix(chart): classify by the authority, and fold only what httpx folds (#142) (aac5a58)
• fix(chart): fold dot forms and stop parsing the URL to classify it (#142) (447fc5e)
• fix(chart): normalise the host before comparing it (#142) (afcd3df)
• fix(chart): compare the parsed host exactly, not by substring (#142) (7538bea)
• fix(chart): host-aware first-party check; tenant-consumable provider default (076824e)
• fix(chart): coherence rule is for first-party providers only (#142) (2cb2871)
• fix(chart): provider-appropriate chat default, and an engine value (#142) (93675bb)
• fix(chart): only pass LLM defaults that are coherent with the provider (#142) (5d235eb)
• fix(chart): give the API pod the install's LLM runtime defaults (#142) (3ec0f6f)
• fix(pricing): complete the fleet backend identity (#142) (c881891)
• fix(pricing): price fleet chat against the backend it actually runs on (#142) (f2375af)
• fix(pricing): price the model chat actually invokes, and family-match tiers (023bd08)
• fix(pricing): price the conversation's model, not the tenant default (8420b5c)
• fix(pricing): chat dedupe must normalise like snapshot matching does (6917ccd)
• fix(pricing): dedupe only the chat role; blast radius covers tier models (80b4bb2)
• fix(pricing): don't stamp a model string twice; report chat in blast radius (d0520f2)
• fix(pricing): chat is a first-class pricing role, not just a gate case (8d62528)
• fix(pricing): the gate must cover the chat model, not only triage roles (3332bfc)
• fix(pricing): recognise api.anthropic.com the way api.openai.com already was (7d30fdf)
• chore(pricing): scope the reservation ledger subquery to the tenant (6fcc085)
• fix(pricing): reservations must mirror enforceable spend (round 3) (fd1e582)
• fix(pricing): close the concurrent-claim window and three phase-4/5 defects (f26e62c)
• fix(pricing): Codex review of phases 4-5 — six findings (33c1119)
• feat(pricing): daily ceiling counts in-flight promises, not just spend (#141 phase 5) (425846d)
• feat(pricing): prefill rates in the form; grandfather existing tenants (#141 phase 4) (b1fdfc0)
• fix(pricing): run the unpriced-model warning on its own session (1dd9f67)
• fix(pricing): an ambiguous namespaced row must not fall through to the family (4423bfb)
• fix(pricing): decide OpenRouter ambiguity before the NULL lookup can preempt it (e8295f3)
• fix(pricing): best-effort check must not be able to fail the request (fdd8a62)
• fix(pricing): OpenRouter's own seeded rows were unreachable (58af7bf)
• fix(pricing): post-commit price check needs tenant context and a rollback (c5c5fc5)
• fix(pricing): close the phase-3 gaps Codex found (f9201bf)
• fix(pricing): NameError in the onboard warning; make F821 fatal in CI (f68674e)
• fix(pricing): onboard gate must not run mid-transaction (#141 phase 3) (d62c78d)
• feat(pricing): provider-aware overrides, gate every entry point (#141 phase 3) (f9f30fb)
• fix(pricing): the switch survives every snapshot path (Codex round 9) (e7478c6)
• fix(pricing): a run with no LLM config still carries the switch (round 8) (cc72410)
• fix(pricing): fleet chat and session scoping (Codex round 7) (9fd8a0f)
• fix(pricing): make cost-tracking-off mean it everywhere (Codex round 6) (d022cfc)
• fix(pricing): Codex round 5 — unlock validated against spend it disregards (e2ab777)
• fix(pricing): Codex round 4 — three more places invented dollars still bit (fe2ec79)
• fix(pricing): Codex round 3 — I broke the provenance SQL; chat only half fixed (722ea33)
• fix(pricing): Codex round 2 — two more P0s in my own fixes (c0c3700)
• revert: un-commit WIP that was not mine to commit (f73a8db)
• fix(pricing): Codex review of phases 1-2 — six defects, one a regression (a66518a)
• feat(pricing): stop enforcing on invented dollars (#124, #141 phase 2) (fad406b)
• feat(pricing): record where every spend figure came from (#141 phase 1) (f212d46)
• fix(pricing): cost-tracking-off now reaches runtime; gate covers tier models (4a1e97f)
• ci: disable cost accounting for the LLM-config plumbing suite (c84dc30)
• fix(ci,pricing): seed the catalog in CI; name the empty-catalog case (c420255)
• fix(pricing): provider_id_for takes the base URL alone (9ab6ce7)
• feat(pricing): a model must be priced to be used, with the switch in the UI (f46dbc7)
• fix(pricing,install): dated model IDs bill correctly; installer can set an endpoint (#139 #138) (08a004c)
• fix: budget payload validation, migration concurrency, slug detection (#134 #135 #136) (2ab5085)
• fix(chart): seed the model price catalog in db-init (#137) (15250f0)
• fix(build): put the price seed in the image build context (bd8d267)
• release: bump every coupled version to 0.2.1 (#131) (460d0ba)
• fix(inference): send the json marker strict schema mode also needs (#131) (f61f706)
• fix: release-review findings on the budget/pricing surface (#131) (beef96d)
• test: update the DB-backed tests for the removed compat shims (2fce6e9)
• revert: remove work-in-progress swept in by an over-broad git add (446cb97)
• refactor: drop the backward-compatibility shims from the budget surface (d8f06b9)
• fix(migration): v1_0043 must backfill runs before writing the policy (#128, #131) (926eaff)
• test(budget): correct the stale failure message in the browser check (ffa9fba)
• fix(misp): never let an unreachable lookup read as "no matches" (#122) (bee62f4)
• fix: repair main after the batch merge of #101-#120 (87c7497)
• fix: Expose per-tenant LLM token budgets in MSSP and te (#113) (6060078)
• fix: Expose per-tenant LLM token budgets in MSSP and tenant UI (#105) (6cc4f4d)
• fix: A terminally failed run is unreachable: no operato (#101) (899ae8e)
• Managed LLM inference pricing: install-level catalog, resolved onto the run (#125) (#126) (d84182a)
• llm-config: per-tenant model price overlay (#121) (#123) (d3cf1a9)
• fix: SSO login for staff accounts (Entra ID / Azure AD) (3634c01)
• fix: SSO login for staff accounts (Entra ID / Azure AD) (123b7ac)
• fix(installer,cli): three RHEL homologation bugs (#116 #117 #118) (bf40bdb)
• fix(l2): rewrite runsWorker.wazuh release prefix on the cross-cluster path (#109 follow-up) (5a2c3d0)
• fix(provisioning): in-cluster (L1) tenants no longer deploy Wazuh twice (#115) (7368b3d)
• docs(readme): align with the docs site, kill em-dashes, add a drift guard (8a35b6c)
• fix: Expose per-tenant LLM token budgets in MSSP and te (34badc2)
• fix(mcp): worker binds zero tools on mcp SDK 2.x — read input_schema too (#111) (fefff76)
• fix: provided-profile installability, worker enrichment, installer consent, create-endpoint strictness (#107 #108 #109 #110) (4552e84)
• fix: Expose per-tenant LLM token budgets in MSSP and te (3d4cefa)
• fix: Expose per-tenant LLM token budgets in MSSP and te (b892c78)
• fix(provisioning): drift sweep must fire on first idle cycle after boot (#104) (736ea43)
• fix(provisioning): reconcile tenant lifecycle against k8s reality (#104) (45ad06f)
• fix(budget): address Codex review of the #103 soft warning (47dec2f)
• feat(budget): 75% soft warning before the hard halt (#103) (fef94f4)
• test(budget): confirm the resolved budget reaches the halt guardrail (#103) (1d61a39)
• feat(budget): per-tenant Agent Run token budget, DB-resolved (#103) (52a3937)
• fix: A terminally failed run is unreachable: no operato (88bfbbc)
• ci: frontend job needs Node 22 (299a925)
• scripts: full-loop live proof for bounded re-triage (eb05b1e)
• runs: re-triage LLM failures, bounded by X attempts (c965009)
• inference: capacity only makes ANSWERED errors terminal (3a2d4c6)
• inference: verdict review fixes — pin the predicate, log the probe, count activity (e93ff2e)
• inference: a running worker is not capacity (a438f30)
• inference: RunPod cold/warm is decided by worker counts, not error prose (b0bb594)
• fix(chat): render assistant messages as sanitized GFM (#98) (220a7a3)
• docs: align llms.txt with the app and soctalk.ai marketing (a58ddc9)
• Revert "Reduce urllib timeout to 1 second for API responsiveness" (#65) (792b612)
• docs: compliance-evidence and identity-adapter brainstorm notes (3809083)
• Allow configuration of persistence storage class (469f9c8)
• test(fleet): live Argentina-tz regression for the legacy-alias fix (49d81cb)
• fix(flight-recorder): resolve legacy tz aliases end to end (Python + Postgres) (758f8c1)
• frontend(fleet): transport bar reveals on hover/focus of the film card (#72) (6a57b50)
• frontend(fleet): rail title + narration in analyst language too (#72) (dd08566)
• frontend(fleet): Codex-consulted analyst vocabulary for guard labels (#72) (66c11df)
• frontend(fleet): analyst-friendly guard labels; drop Model Spend tile (#72) (6150cd1)
• test(frontend): suite oracles follow the shown (fallback) day (#72) (cba2cc6)
• fleet: latest-active-day fallback for empty days (#72) (e8b09cb)
• worker: release-and-retry on transient serverless cold-start (#77 Phase 1) (71a5221)
• install.sh + packaging: portability/robustness fixes; drop the .apk (Codex review) (480df60)
• test(frontend): session verification/recording specs; uv.lock version sync (#72) (608bee0)
• test(frontend): stabilize pervasive demo suite; record authz-facts known issue (#72) (cc8f178)
• fleet(api): gate drill links on the CALLER's audience, not the session's (#72) (698bf0a)
• fleet(api): no drill-down links to investigations the caller cannot open (#72) (649aafb)
• frontend(nav): gate Staff Users on MSSP user; pervasive demo correctness suite (#72) (321f491)
• test(frontend): read-only UI correctness suite for the live demo box (#72) (9424366)
• frontend(fleet): counters accumulate with the replay playhead (#72) (02639a4)
• demo-seed: provider reports ZERO usage — playback is not inference (#72) (eb8a428)
• demo-seed: tz-aligned lapse window + preflight/launcher fixes (#72) (f01f4ef)
• demo-seed: Codex-hardened cost-safety + robustness (#72) (c6da4c2)
• demo-seed: local validation fixes — provider shape-agnostic, authz scoping, cost-safety (5dd02bd)
• demo-seed: no-inference demo data seeder (#72) (1d1a950)
• fix(#72): two live-e2e-caught bugs + the live e2e spec itself (036a7ce)
• quality(#72): Codex review fixes — flush retry, dedup, dead code, reuse (994cb09)
• docs(ova-esxi): both boot paths validated on shipped v0.2.0 OVA (37a4c61)
• frontend(fleet): live by default on tenant home; lapse demoted on analytics (#72) (6c5bc72)
• api(replay): fleet-live snapshot endpoint (#72 — Codex live-default adjudication) (9416abd)
• frontend(tests): flight-recorder Playwright specs (#72) (88b653d)
• frontend(fleet): fleet-day hero on analytics — glyph map, time-lapse, drill-down (#72 phase 3) (7a234c2)
• frontend(replay): flight-recorder core + replay view on investigation detail (#72 phases 1-2) (f598f98)
• ci(packer): authenticate packer init's plugin getter (avoid 60/hr limit) (10327ec)
• ir(replay): human-lane beats in the IR feed (#72 phase 0) (9bf5999)
• api(replay): fleet-day aggregate endpoint + replay event indexes (#72 phase 0) (e50be8e)
• api(replay): cursor-capable events feed with server_now (#72 phase 0) (c66f54f)
• ir(replay): authoritative terminal beats from L1 (#72 phase 0) (b6bbf71)
• graph(replay): worker event sink + lease-checked events endpoint + node beats (#72 phase 0) (30bf46b)
• ir(replay): pipeline replay event vocabulary + typed payload builders (#72 phase 0) (4374af3)
• add-llms-txt (c9415ac)
• optimize memory allocation pattern (4b487eb)