v0.6.0 — official images + one-command install

Highlights

Official container images + a one-command install. Operant now publishes
multi-arch images to GHCR on every release and ships a zero-checkout installer —
no clone, no Node, no build.

curl -fsSL https://raw.githubusercontent.com/tomascupr/operant/v0.6.0/install.sh | bash

It generates fresh secrets, pulls the images, and boots Postgres + the control
plane + the OpenClaw gateway, then prints your dashboard URL and admin token.

Or run the control plane directly against any Postgres (it migrates on boot):

docker run -p 8080:8080 \
  -e DATABASE_URL=postgres://user:pass@host:5432/operant \
  -e OPERANT_SECRET_KEY="$(openssl rand -base64 32)" \
  ghcr.io/tomascupr/operant/control-plane:latest

Images: ghcr.io/tomascupr/operant/control-plane (linux/amd64,
linux/arm64) and ghcr.io/tomascupr/operant/openclaw-gateway (linux/amd64).
Tags: latest, 0.6.0, 0.6.

Added

• official multi-arch container images and one-command installer

Fixed

• point Helm and deploy checks at the published control-plane image

Documentation

• document container images, one-command install, and release publishing

v0.5.3 — security & correctness fixes

Documentation

• position Operant as the self-hosted alternative to Claude Tag (5bbfcc1)

Fixed

• close approval, RBAC, rate-limit, redaction, and retention-wipe gaps (8f92835)

Security note

This release closes several issues found by an adversarially-verified audit.
Self-hosters should upgrade:

• Approval gate: a multi-approval decision could report approved before
  minApprovals was met, and a requester could approve their own request. Both
  are fixed — separation of duties is now enforced.
• Privilege escalation: a users:write holder could mint a *:* custom
  role and self-assign it. Role upserts now reject granting any permission the
  actor does not already hold.
• Brute force: admin-login-token guessing was unthrottled on /api/bootstrap
  and the /api/config/credentials owner-bootstrap path; both now share the
  per-IP rate limiter used by /api/auth/login.
• Data hygiene: full-workspace wipe and retention export now cover memory,
  skills, and scheduled workflows; redaction catches more credential key shapes
  and tokens glued to preceding text; and the generated OpenClaw config enforces
  deny-beats-allow before serialization.

v0.5.2

Documentation

• reflect source-scrubbing, boot-only seeding, and workflow locking invariants (ebc050c)

Fixed

• workflow apply/delete locking, intent-based reconcile, boot-only seeding, strict secret-key parsing (23a5b9e)

Upgrade note

OPERANT_SECRET_KEY parsing is now strict: the key is interpreted as base64 only
when the whole string is valid base64. Standard openssl rand -base64 32 /
pnpm init:env keys, 64-hex keys, and 32-byte raw strings are unaffected. A
base64url-encoded key (containing - or _) that happened to work before
will now fail loudly at boot with a clear message rather than silently deriving a
different key — re-encode it as standard base64. pnpm doctor --preflight-only
now applies the same rule, so it catches this before boot.

v0.5.1

Documentation

• sharpen the README for OSS, document scheduled workflows, and correct API/contributor docs (7f0b11a)

Fixed

• harden redaction, gateway-output scrubbing, fetch timeouts, and workflow materialization (3fd83c5)

v0.5.0

Added

• governed scheduled workflows (2ef16ba)

Documentation

• document governed scheduled workflows (v0.5.0) (8cc929d)

v0.4.0 — Governed team memory + skills

Added

• governed team memory + skills store (20e0e6c)

Documentation

• document governed memory + skills (v0.4.0) (942711f)

Fixed

• upgrade the Operant plugin in place on reused state volumes (8d5a49b)

v0.3.1: principal-aware Pipedream policy + Teams attribution

A correctness and dual-identity release that closes the two security findings deferred from v0.3.0.

Fixed

• Per-user Pipedream policy is now enforced by principal. evaluateToolOnly, the gate behind every Pipedream plugin surface (policy check, Connect token, action discovery), was principal-blind: it matched tool policies on tool plus action only. A policy an admin scoped to a single Slack or Teams user or role was therefore enforced for everyone (a scoped deny over-blocked the whole workspace; a scoped allow over-granted). The principal-aware tool-policy gate that the dashboard already used is now shared by both surfaces, so a scoped grant only applies to a matching principal and a scoped grant with no match denies instead of falling through to a global allow.

• Microsoft Teams actors are attributed correctly. The plugin keyed every Pipedream principal as a Slack id, so Teams (msteams) users were mislabeled end to end: audited as Slack actors and unmatchable by Teams-scoped policy. The plugin now forwards a platform-neutral principal id and the control plane resolves the platform from its shape (Teams AAD ids are UUIDs, Slack ids are not), threading it through both policy evaluation and audit. A new indexed actor_teams_aad_user_id audit column (migration 012) makes Teams actors attributable and queryable, mirroring actor_slack_user_id.

Per-user Pipedream Connect OAuth isolation, tool policy, and audit now all key on the active chat user's principal on both Slack and Teams.

Notes

• Adds migration 012_audit_actor_teams_aad_user_id.sql (append-only; applied automatically on boot).
• The internal plugin wire field slackUserId is renamed to principalId across the plugin and control plane; the plugin and control plane ship together, so no action is needed for a standard deploy.
• The remaining low-severity hardening item from v0.3.0 (Connect-token origin trusts X-Forwarded-Host) is unchanged and still tracked.

Full commit-level changelog: CHANGELOG.md.

v0.3.0: Microsoft Teams

Operant now governs agents in Microsoft Teams as well as Slack, as a dual-identity control plane.

Highlights

• Microsoft Teams is a first-class, dual-identity chat platform alongside Slack: a user can carry a Slack ID, a Teams AAD ID, or both, and channel/tool/approval policy plus audit and approvals key on the active platform's principal.
• Teams ingress runs through an Azure Bot Service webhook into OpenClaw's msteams channel. The gateway image now packs the @openclaw/msteams channel plugin (non-fatal install, so Slack-only stacks still come up).
• Dual-identity policy: tool entitlements and named-approver policies scope to per-user (Slack member ID or Teams AAD ID) and per-role principals; channel policies gained Teams team/channel allowlisting.
• Teams Azure Bot credentials (the app password) are stored AES-256-GCM encrypted in Postgres via SecretRefs; the app and tenant ID are kept as plaintext workspace settings.
• The admin dashboard adds a Teams path: Teams sign-in (AAD principal), a Setup section for Teams app ID/password/tenant ID and webhook port/path, and Teams-aware policy and people management.
• New Teams live-acceptance tooling: pnpm teams:live:preflight, teams:live:e2e, and teams:live:e2e:manual, with a documented live-env contract (deploy/teams/live.env.example).

Fixes and hardening

• Redaction: AWS access keys glued to trailing characters no longer leak, and set-cookie/cookies/credentials keys are now redacted.
• Plugin: tok_ access tokens are redacted to match the control-plane sanitizer, and the internal control-plane fetch is bounded by a 10s timeout so a hung control plane cannot stall a tool call.
• User upsert: a colliding Teams bot user ID now returns a clean 409 instead of a raw 500 that leaked the Postgres constraint name.

OSS housekeeping

• Added CODE_OF_CONDUCT.md, issue and PR templates, and CODEOWNERS.
• Documentation brought to Slack/Teams parity across setup, API, compliance, acceptance, SECURITY, README, and CLAUDE.

Known limitations (tracked for a follow-up)

A security and correctness review surfaced these; they are documented here rather than fixed in this release:

• Per-user Pipedream policy is principal-blind on the live plugin path (evaluateToolOnly): a tool policy scoped to one user or role is currently enforced for everyone (a scoped deny over-blocks; a scoped allow over-grants). Treat per-user Pipedream gating as not yet enforced on the plugin surface.
• Pipedream identity is Slack-only: the plugin keys Pipedream Connect on the Slack sender ID, so a Teams user's Pipedream activity is attributed to a Slack actor and Teams-scoped tool policies cannot match. Teams per-user usage rolls up as unattributed, and Teams audit attribution is metadata-only (no dedicated indexed actor column yet).
• Connect-token origin trusts X-Forwarded-Host: a hardening item for the Pipedream Connect allowedOrigins.

Full commit-level changelog: CHANGELOG.md.

v0.2.0

[0.2.0] - 2026-05-22

Added

• Add one-click Slack app creation link (f0cd007)
• Add real-workspace screenshot to README (1fcf6bd)
• Add Unreleased section, strip dead commit hashes (5e92b64)
• Add self-serve Pipedream marketplace (4f578b3)

Fixed

• Fix CI: let pnpm/action-setup pick version from packageManager (dccfa15)

Other

• Rewrite README from first principles for accuracy and clarity (c723fb4)
• Polish for public-release flip (a272cde)
• Smooth the first-time install path (edc62d5)
• Reposition as 'self-hosted agents in Slack' (fc70e9a)
• Close quickstart gap after compose:up (a1c9b8e)

v0.1.0

First public release of Operant, an MIT-licensed self-hostable control plane for Slack AI on OpenClaw.

Highlights

• Per-user OAuth credentials via the optional Operant OpenClaw plugin and Pipedream Connect. 2,500+ SaaS tools accessible from Slack under each employee's own identity, audited under the right human.
• Real RBAC: six built-in roles plus arbitrary custom (action, resource) permission pairs, channel allowlists, per-user/per-role tool entitlements, named-approver policies.
• AES-256-GCM credential encryption in Postgres with SecretRef-backed OpenClaw config; plaintext never leaves the control plane.
• One-Compose-project-per-workspace trust boundary. Postgres, Redis, OpenClaw state, and generated config volume are scoped by project name. Host ports bind to 127.0.0.1 by default.
• Static same-origin admin dashboard for Setup, Health, Policy, People, Approvals, Activity, Usage, Data, OpenClaw operator views. No bundler, no external scripts.
• Live and strict acceptance verifiers (pnpm live:e2e, pnpm compose:e2e) for customer acceptance packages.

Requirements

• Node.js 24+, pnpm 11+
• Docker Engine and Docker Compose v2
• Default OPENCLAW_VERSION is 2026.5.18

Quickstart

pnpm install
pnpm init:env
pnpm compose:up -- -d
open http://localhost:8080

Full walkthrough in docs/setup.md.

Known limitations

• Helm chart and Fly artifacts ship but have not been runtime-verified against a real cluster; please file issues if you exercise either path.
• Strict live acceptance (pnpm compose:e2e --require-* flags) requires a real Slack workspace with the included manifest installed and an OpenClaw operator device paired against the gateway (see docs/setup.md and docs/acceptance.md).

Reporting issues

• Bugs: open a GitHub issue with the output of pnpm doctor.
• Security: email work@tomcupr.com per SECURITY.md. Do not open public issues for security reports.