SOIT v1.0.0

SOIT v1.0.0 Release Notes

SOIT v1.0.0 is the first public release of the SOIT Community platform: a
self-hosted, governed agent runtime for teams that need AI agents to operate
against real enterprise systems with permissions, secrets, egress policy,
audit, cost attribution, tracing, and replay built into the runtime.

Highlights

• Agent runtime — build, publish, and execute agents with versioned
  capability bindings, native function calling, streaming over SSE on a
  durable interaction path, automatic RAG retrieval, snapshot-based retry,
  and regression baselines that gate publishing.
• Workflow engine — a visual builder with canonical node schemas,
  publish/execute/monitor/retry/replay with full run linkage,
  checkpoint-based resume, and orphan-run reclamation with a unified
  dead-letter view.
• Knowledge — document upload, parsing (PDF, Word, Markdown, plain
  text), chunking, indexing, retrieval with citations, and lease-based
  ingest workers with orphan recovery.
• ModelHub — provider setup, diagnostics, and model-neutral routing
  across OpenAI, Anthropic, DeepSeek, Qwen, and OpenAI-compatible endpoints.
• Plugins, tools, and MCP — plugin-first governance for MCP server and
  Skill artifacts, a package trust chain with revocation, and OAuth 2.1
  client support for protected MCP servers.
• Governance and observability — a unified Run / Task / RunStep / Trace
  ledger with replay and Audit Explorer, cost attribution down to priced
  usage rows with credit enforcement, scoped expiring API keys, egress
  policy on all outbound paths, and an LLM-as-judge evaluation module.
• Deployment — a single-command Docker Compose quickstart with every
  published host port overridable, non-root container images, and a
  hardened production profile.

Supply-Chain Artifacts

This release publishes digest-addressable images for server,
knowledge-worker, and web to GHCR, together with SPDX JSON SBOMs,
GitHub/Sigstore build provenance and SBOM attestations, a deterministic
source archive, and SHA256SUMS.

Verify downloads with sha256sum -c SHA256SUMS and verify image and SBOM
attestations with gh attestation verify.

Database Compatibility

• Fresh installations migrate from base to 20260803090000.
• The supported N-1 upgrade range is 20260718140000..20260803090000.
• Older or unknown development snapshots require a new database or an
  operator-managed export/import path.

Known Limitations

• Content safety and PII detection are not implemented. The runtime exposes
  a content safety port and an HTTP adapter so a deployment can plug in a
  classifier it operates; with no adapter configured, no content inspection
  happens.
• The MCP adapter targets the MCP SDK v1 line over streamable HTTP with the
  client_credentials grant; the browser-based authorization-code flow and
  the stateless 2026-07-28 protocol revision are not supported.
• The workflow builder ships 8 core node types plus plugin-exported node
  types; loop, code-execution, and parameter-extraction nodes are not
  included.

License

SOIT Community is released under the Apache License 2.0.

See CHANGELOG.md for the complete change list.