SOIT v1.4.0

SOIT v1.4.0 Gateway Operations Release Notes

Status: released on 2026-09-29 as tag v1.4.0 (commit f7bc1a6).

Highlights

• The gateway can run on its own: SOIT_ROLE=gateway starts a process that
  serves only /v1, /mcp with its discovery metadata, /api/v1/tools and
  health, with none of the background work, so it can be scaled and exposed
  apart from the console's API.
• Budgets hold correctly under load: checking a budget and holding it are one
  Redis step, a hold is released once its call's cost is committed or its run
  ends, a long image call stays held to the end, and holds are kept in the
  process while Redis is unreachable. Each threshold alert is judged as of
  the cost that crossed it, so a lagging dispatcher no longer skips one.
• Image calls take quality, sent on the routes that carry it and priced
  through a model's image_variants (by quality, size or both). A timed-out
  image call, or one lost with its process, is charged the images it asked
  for, and the image job reaper fails the runs a lost process leaves behind.
• A native Gemini adapter serves chat, streaming, tool calls (with thought
  signatures returned), structured output, inline images and embeddings;
  LiteLLM stays the default and serves Gemini's image generation.
• The runtime reads a signed Enterprise license: a verified, unexpired one
  makes the process Enterprise with the feature keys an installed package
  defines, anything else leaves it Community and says why, and a daily
  heartbeat applies a lapse or renewal. Extension packages mount through the
  soit.feature_registries and soit.extensions entry points. Diagnostics
  and Settings › About show the edition.
• Opt-in anonymous telemetry, off by default: one report a day with the
  version, edition, deployment facts, five usage counts and the enabled
  feature keys; GET /api/v1/diagnostics/telemetry shows the exact report.
• Model servers on your own network: EGRESS_PRIVATE_NETWORKS names private
  or loopback networks governed calls may reach (a local Ollama, an
  on-premises vLLM); every non-public address was refused before.
• /health/ready answers within about two seconds when the vector store is
  unreachable, so a compose stack without Milvus becomes healthy.
• Security: exception text no longer reaches workflow and run stream error
  events or error responses; content-free runs keep tool content, failure
  text and evidence content out of the records; an API key's limits count
  direct tool calls.
• Dependencies: React 19.3, React Router 8.4, Vite 8.3, SQLAlchemy 2.0.54 and
  current releases of the other libraries, with the held ones listed in the
  changelog.

Database Compatibility

• Fresh installations migrate from base to 20260927190000.
• This release adds no migrations: a v1.3.0 database needs none.
• The supported N-1 upgrade range stays 20260927160000..20260927190000.

Upgrading

1. Nothing to migrate. Restart the API and workers on the new images.
2. Behaviour changes to review:
   • A budget hold now lasts until its call's cost is committed or its run
     ends, at most the call's timeout and a minute; before it lasted a
     minute. Near a limit, fewer finished calls hold it shut.
   • /v1/images/* sends quality instead of refusing a non-default value;
     a route that cannot carry it answers 422 route_cannot_carry.
     /api/v1/images/* accepts quality.
   • /v1/models reads the model list through a kernel port; the answer is
     unchanged.
   • Settings are validated for SOIT_ROLE (all or gateway) and
     EGRESS_PRIVATE_NETWORKS (CIDR; 0.0.0.0/0 is refused).
3. To run a separate gateway, start extra processes with SOIT_ROLE=gateway
   and keep at least one process with the default role.
4. To use a model server on a private network, set
   EGRESS_PRIVATE_NETWORKS and add the server to the workspace or tenant
   egress allowlist.

Known Limitations

• A call that fails keeps its budget hold until its run ends; a run that
  never ends on the process that admitted the call releases it only when it
  expires.
• Gemini's native adapter counts embedding tokens at four characters a token,
  since Gemini reports none; it takes images only as inline data: URLs.
• The Gemini native adapter and real-provider paths (OpenAI, Anthropic tool
  calling, Ollama) have unit and mock coverage; live-credential evidence is
  pending.
• The license heartbeat and telemetry are log lines and one daily POST; no
  license server is contacted.
• The telemetry receiver at https://soit.ai/api/telemetry must be deployed
  before enabled installations' reports are kept.
• The known limitations of v1.3.0 still apply, except where the changelog
  lists them as fixed.