v1.19.0

Added

• Email notifications. New [email] config block (stdlib SMTP:
  STARTTLS/implicit-TLS, AUTH PLAIN/LOGIN; default off, fail-soft —
  a delivery failure never affects evaluation). Rides the existing alert
  evaluators: org budget alerts, org obs-alert rules, and node-side
  [observability.alerts]. See docs/email-notifications.md.
• Scheduled cost digests. Weekly/monthly digest emails on both the node
  ([digest]) and the org server: period spend, per-model/per-project (org:
  per-developer) breakdowns, movers vs prior period. Restart-safe send-once
  de-dup via the new digest_state table (agent migration 060, server
  migration 021). Test on demand with observer digest send --dry-run /
  observer-org digest send --dry-run.
• Shareable cost card. observer report share [--period week|month] [--markdown] renders a 1200×630 SVG social card + markdown summary of your
  observed spend (period total, cache-read share, model/tool leaderboards).
  Aggregates only — project names/paths never appear (pinned by test). No
  network.
• Admin dashboard (web2) onboarding & navigation. First-run checklist for
  a fresh org server, command-palette data search (teams / projects /
  people / recent sessions), teaching empty states across pages, breadcrumbs
  on detail routes, and sidebar count badges.
• Plane-A general-observability upgrades. web2 Admission center
  (/trajectories/admission, read-only policy viewer) + T6 admission
  org-wire tier ([org_client.share.obs].admission, default off; server
  migration 019) with audited deep reads; T7 per-item eval tier
  (.eval_items, server migration 020) with per-item EvalRun detail and
  run-vs-run compare; per-end-user spend page; node-side alert
  evaluation for share-off deployments ([observability.alerts], default
  off); LLM-judge robustness (map-reduce chunking, per-criterion prompts,
  hardened client) + observer obs admission verify; SDKs attach
  prompt/response content by default (OBSERVER_CAPTURE_CONTENT=0 to
  disable) and target the correct node port :8081; POST /policy?persist=1
  write-through.
• M365 Copilot org-tier connector (server-side native-console poller,
  server migration 018; never on the agent wire).
• Browser-chatbot capture extension (preview). Opt-in MV3 extension
  capturing ChatGPT / Claude.ai / Perplexity / Gemini / consumer-Copilot web
  chats via a native-messaging bridge (observer browser hook). Load-unpacked
  only for now — not yet published to the Chrome Web Store; all token
  counts are estimates.
• Website. Text-first, fully indexable homepage (the Observer Quest
  arcade lives on at /arcade); product deck at /deck with a downloadable
  PDF; 28 per-tool "track costs" pages generated from the adapter
  registry; 6 comparison pages; 21-term glossary; a public two-planes
  explainer; llms.txt + JSON-LD + an explicit GEO robots posture
  (retrieval crawlers allowed, training crawlers opted out).

Changed

• READMEs and store listings overhauled around the durable story:
  proxy-accurate billed-token attribution, local-first privacy, free node →
  team layer. One true adapter count (26) everywhere; npm/PyPI/VS Code
  listing descriptions rewritten; MCP tool census corrected to 25 (21
  always-on + 4 conditional) and docs/mcp-tools.md fully rewritten.
• Org-server retention is now enforced. server.data_retention_days
  (default 730) actively prunes: upgraded org servers begin deleting
  rows older than the configured window (identity/config/audit/guard-chain
  tables are never pruned). Set the knob before upgrading if you need longer
  retention.
• Guard alerting (desktop toasts, Slack/Discord/PagerDuty webhooks) and
  process observability are now documented on the main surfaces.

Fixed

• VS Code walkthrough listed a nonexistent "Continue" adapter; stale
  "seventeen tools" counts across README/website/listings; dead help entries
  in the node dashboard; org migrate-test schema assertion; a date-dependent
  test (TestAggregateForOrg) that failed once its hardcoded day aged out.

Upgrade notes

• Agent DB migrates to schema 60; org server to 21 — both automatic.
• Restart the daemon via the safe order (route off → stop → relaunch →
  route on; scripts/restart-daemon.sh) so the new binary and migrations
  load.
• Email/digests stay inert until you set [email].enabled = true plus the
  per-consumer opt-ins.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.19.0-linux-x64.tar.gz
Linux arm64	observer-v1.19.0-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.19.0-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.19.0-darwin-arm64.tar.gz
Windows x86_64	observer-v1.19.0-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.19.0

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.19.0-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.19.0

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.19.0 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private