v1.34.0-rc.6

Pre-release on the edge channel; rc.5 plus two org-dashboard fixes found on the demo estate
(the OIDC login gate and the SCIM-hidden team create form). Cut so the org-feature validation
arc runs on a signed image carrying them:

• Org dashboard: the Teams page no longer hides its team CREATE form on a SCIM
  deployment (D-DEMO-7). It gated the form on scim_configured, which only
  means [scim].auth_token_path is set - and the appliance bundle always
  provisions a SCIM token secret, so on every bundle-deployed org the admin
  could not create a team at all (and a team budget had nothing to attach to),
  even with zero SCIM-provisioned rows. GET /api/org/team-management now also
  carries scim_active, resolved from the data (a non-empty external_id on
  any org_teams or org_members row), and the page always offers the form
  and uses the two flags to choose a notice instead - the D-DEMO-6 "offered,
  not hidden" rule. An individual SCIM-provisioned team is still read-only by
  provenance, unchanged.
• Org sign-in: a configured rail is offered before its first probe (D-DEMO-6).
  The login page hid the link for any rail whose health was not exactly ok,
  but an OIDC rail's discovery document is fetched lazily and following that
  link was the only thing that fetched it - so on a fresh boot the first
  sign-in could never be started. Health is now a tri-state that decides what
  is said beside a rail, never whether it exists, and the server warms the
  probe at boot.
• Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.34.0-rc.6-linux-x64.tar.gz
Linux arm64	observer-v1.34.0-rc.6-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.34.0-rc.6-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.34.0-rc.6-darwin-arm64.tar.gz
Windows x86_64	observer-v1.34.0-rc.6-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.34.0-rc.6

Org server (Teams)

The self-hosted org server is an enterprise-licensed product distributed from SuperBased's private container registry with a per-customer pull token issued with your enterprise licence; its release assets are not attached here. Contact sales for a pull token. The pull-and-verify recipe for your exact release is the README.md of the deployment bundle (observer-org deploy export).

Enterprise updates

This release publishes on the edge channel.

Each agent archive carries a detached vendor signature (<archive>.sig, raw Ed25519 over the archive bytes) and the release ships a signed update-manifest-edge.json. Self-hosted org servers consume them with:

observer-org update sync --version v1.34.0-rc.6
observer-org update publish --channel edge --version v1.34.0-rc.6

For a disconnected server, download observer-v1.34.0-rc.6-airgap-bundle.tar (archives + signatures + SHA256SUMS + the signed manifest + provenance), carry it across the gap, and run observer-org update import --version v1.34.0-rc.6 --bundle <dir>.

Supply chain

A CycloneDX SBOM for the agent is attached: observer.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private