v1.34.0-rc.5

Pre-release on the edge channel; rc.4 plus the demo-estate rebuild waves and two org-dashboard
fixes found on the first fresh org that booted from rc.4. Cut so the demo estate can run a
cosign-signed image carrying them (first boot pins the release workflow's signing identity):

• Org dashboard: Settings no longer crashes on a fresh org (GET /api/org/plane-b/mode served
  "pending": null for a fleet with no capability acks and the page read .length on it; the
  activate endpoint's Node-Mode downgrade result seeded the same way), and the People
  leaderboard's TOP TOOL / TOP MODEL are derived by count from every substrate (actions ->
  sessions -> token rows for the tool; the deduped proxied-turn ∪ token-row union -> sessions for
  the model) instead of the cost-ranked proxied-turns-joined-to-sessions query that left every
  developer on a free-tier model, or without a joinable proxy session, at "-".
• Azure appliance modules: lb_nodes = 1 (single HAProxy, stated full-outage replace window,
  DR-63) and nats_placement = dedicated (the nats-single broker on its own VM); the org POLICY
  signing key is now minted beside the bearer key (policy-signing-key, both clouds), landed by
  env-sync and rendered as [policy] in every production config - without it every managed
  node's GET /api/agent/budget answered 409 and observer <tool> refused to launch;
  restore-drill.sh --pgbackrest-conf for the separate-PostgreSQL topology; the app NSG
  metrics rule admits the VNet; env-sync's PFX converter fails loudly and keeps SAS values out
  of comment lines.
• budgetsigningcheck warns on managed tokens / managed nodes without a policy key and
  new-enrolment-token --managed warns at mint time; node posture (budget + pricing) is fetched
  before every push and observer org push-now carries it.
• Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.34.0-rc.5-linux-x64.tar.gz
Linux arm64	observer-v1.34.0-rc.5-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.34.0-rc.5-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.34.0-rc.5-darwin-arm64.tar.gz
Windows x86_64	observer-v1.34.0-rc.5-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.34.0-rc.5

Org server (Teams)

The self-hosted org server is an enterprise-licensed product distributed from SuperBased's private container registry with a per-customer pull token issued with your enterprise licence; its release assets are not attached here. Contact sales for a pull token. The pull-and-verify recipe for your exact release is the README.md of the deployment bundle (observer-org deploy export).

Enterprise updates

This release publishes on the edge channel.

Each agent archive carries a detached vendor signature (<archive>.sig, raw Ed25519 over the archive bytes) and the release ships a signed update-manifest-edge.json. Self-hosted org servers consume them with:

observer-org update sync --version v1.34.0-rc.5
observer-org update publish --channel edge --version v1.34.0-rc.5

For a disconnected server, download observer-v1.34.0-rc.5-airgap-bundle.tar (archives + signatures + SHA256SUMS + the signed manifest + provenance), carry it across the gap, and run observer-org update import --version v1.34.0-rc.5 --bundle <dir>.

Supply chain

A CycloneDX SBOM for the agent is attached: observer.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private