v1.77.0-rc.2

sluis v1.77.0-rc.2

Image	ghcr.io/truvity/sluis/sluis:1.77.0-rc.2
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.77.0-rc.2
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.77.0-rc.2
Chart	oci://ghcr.io/truvity/charts/sluis:1.77.0-rc.2
TypeScript	@truvity/sluis@1.77.0-rc.2 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.77.0-rc.2

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.77.0-rc.2_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.77.0-rc.2_linux_arm64.zip,
sluis-slack_1.77.0-rc.2_linux_arm64.zip, sluis-google_1.77.0-rc.2_linux_arm64.zip,
sluis-cloudflare_1.77.0-rc.2_linux_arm64.zip and
sluis-backup_1.77.0-rc.2_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• ba785fe: feat(hack): run the conformance suite against an installation on Lambda (@excavador)
• 3bcf4c0: feat(security): verified Google sign-in, GitHub id pins (@excavador)
• 78ca4da: feat(policy): pkce per client; a code bound to a challenge needs its verifier (@excavador)
• ca47553: feat(console): an operator can turn the recovery sign-in off, and only off (@excavador)

Bug Fixes

• fb4c635: fix(issuer): bind sessions, revocation and parameters; carry acr on refresh (@excavador)
• 865d0bc: fix(security): per-source recovery throttling, audience-checked reviews, changelog (@excavador)
• 6b4ce0d: fix(issuer,console): harden the web surface (2026-10-18 review) (@excavador)
• d1202ad: fix(issuer): review fixes for the web hardening (@excavador)
• db3d5d3: fix(audit,minter,issuer,sluisctl): harden the audit pipeline and the lower findings of the 2026-10-18 review (@excavador)
• 4d4c506: fix(audit,minter,issuer): review fixes for the audit pipeline hardening (@excavador)
• ad78e50: fix(sluisctl): shut the login callback down instead of closing it (@excavador)
• 94877ef: fix(deploy): harden the Pulumi libraries' keys, buckets, trusts and release checks (@excavador)
• 21b455a: fix(deploy): keep partition literals out of the leak canary, drop an emphasis word from the docs (@excavador)
• e3e281a: fix(deploy): scheduler trusts name the schedule group, write-once covers PutObject only, explicit lock mode (@excavador)
• 2929f4b: fix(backup): a restore verifies a backup against the sealed audit trail (@excavador)
• 9d8e8a6: fix(backup): pin the observer, read every page, keep the unverified decision, and refuse a record that disagrees (@excavador)
• 7152462: fix(backup): ignore foreign observers, never fail open on the decision, bound by (@excavador)
• d918089: fix(issuer): say only what the issuer does: claims, response modes, unserved routes (@excavador)
• 5562ab1: fix(issuer): answer /userinfo bearer failures as RFC 6750 asks (@excavador)
• ca47743: fix(issuer): redirect, hint and logout rules of OIDC Core, RFC 8252 and Back-Channel Logout (@excavador)
• f9aa2ad: fix(issuer): review fixes: /end_session hint binding, fail-closed confirmation, post-logout loopback (@excavador)
• bcc64ba: fix(console): harden turning recovery off after the security review (@excavador)

Other

• c5715de: chore(release): retire the old access-roster packages (@excavador)
• cea87e1: test(audit): keep an account-shaped string out of the config test (@excavador)
• 4592f33: docs(changelog): name no role of an installation (@excavador)
• d4e79f8: test(issuer): give each parallel subtest its own server; drop an unused parameter (@excavador)
• b4a12f9: docs(pulumi): the backup lock and checksum changes ship in v1.77.0, not v1.78 (@excavador)
• d9f0955: style(policy): wrap the pkce error to the line limit (@excavador)
• 9131082: Merge origin/master into feat/recovery-disable (@excavador)

v1.77.0-rc.1

sluis v1.77.0-rc.1

Image	ghcr.io/truvity/sluis/sluis:1.77.0-rc.1
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.77.0-rc.1
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.77.0-rc.1
Chart	oci://ghcr.io/truvity/charts/sluis:1.77.0-rc.1
TypeScript	@truvity/sluis@1.77.0-rc.1 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.77.0-rc.1

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.77.0-rc.1_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.77.0-rc.1_linux_arm64.zip,
sluis-slack_1.77.0-rc.1_linux_arm64.zip, sluis-google_1.77.0-rc.1_linux_arm64.zip,
sluis-cloudflare_1.77.0-rc.1_linux_arm64.zip and
sluis-backup_1.77.0-rc.1_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• 45e2965: feat: backup and restore preview/status through the issuer, with discovery (@excavador)
• 9af00f9: feat(log): backend log lines carry trace_id, span_id and trace_flags (@excavador)
• e9c578d: feat(chart)!: dashboards as grafana-operator objects, retire the AccessRoster alerts (@excavador)
• ec4ba3c: feat(telemetry): AWS SDK calls are spans and client metrics; Lambda span carries faas.invocation_id (@excavador)
• b612f8c: feat(telemetry): document and test OTel sampler variables; fix(signer): KMS sign runs under the request context (@excavador)

Bug Fixes

• 28c0a51: fix: harden the issuer route of backup and restore after review (@excavador)
• eb58201: fix(issuer): a supplied verify-only key is EC P-384 or RSA of 2048 bits or more (@excavador)
• 824b001: fix(resourceproxy): clean the method and tool the audit line logs (@excavador)
• f340c5f: fix(backup): the blob grants follow the blob key prefix (@excavador)
• 21edc97: fix(backup): the maintenance gate reads the backup table (@excavador)
• b545033: fix(backup): the backup and restore role policies fit IAM's inline limit (@excavador)
• fee1a96: fix(build): format, line length, tidy deploy modules for the AWS telemetry adapters (@excavador)

Other

• 21ed59a: ci: ci-workflows v3.33.0, ci-actions v1.18.0 (@excavador)
• 1b6aa1f: test(telemetry): context first in the log-line helper (@excavador)
• 1882121: ci: move the service containers to a compose file and the e2e lanes to recipes (@excavador)
• 8c3f223: ci: build the console once and hand it to the Go groups as an artifact (@excavador)
• 19a822c: ci: pages deploys the site, the docs group builds and checks it (@excavador)
• 9d8167b: ci: the weekly link check moves into security.yaml, the changed-links check into the docs group (@excavador)
• 8c8c728: ci: the conformance Config profile is a recipe, run on demand from security.yaml (@excavador)
• 498f508: ci: fix the references to the removed workflows and fetch the base for the changed-links check (@excavador)
• 2fdb68c: ci: keep the docs word budget (@excavador)
• 525a7f7: docs(operate): keep the operate guide within its word budget (@excavador)
• 8346b43: ci(telemetry): lint the dashboards the chart ships now (@excavador)
• 605486d: docs(operate): keep the operate guide within its word budget (@excavador)
• 9116b37: style(audit): keep the SDK client constructions within the line limit (@excavador)
• da7e5de: style(signer): gofmt (@excavador)
• 9bc3ed6: docs(changelog): mark the chart dashboards and alerts change as Breaking (@excavador)

v1.76.10

sluis v1.76.10

Image	ghcr.io/truvity/sluis/sluis:1.76.10
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.10
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.10
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.10
TypeScript	@truvity/sluis@1.76.10 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.10

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.10_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.10_linux_arm64.zip,
sluis-slack_1.76.10_linux_arm64.zip, sluis-google_1.76.10_linux_arm64.zip,
sluis-cloudflare_1.76.10_linux_arm64.zip and
sluis-backup_1.76.10_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• aa7bcc3: feat(config): FromAccess builds the installation's access section (@excavador)
• f7d8939: feat(audit): build the digest signing key and export the archive key grants (@excavador)
• 66cf5a3: feat(config): write the installation document in one canonical form (@excavador)

Bug Fixes

• b4bd290: fix(config): satisfy lint and the leak canary in FromAccess (@excavador)
• fe9c126: fix(audit): keep account ids and ARN prefixes out of the digest key tests (@excavador)
• c1ed2ce: fix(config): respell only duration-typed values in the installation writer (@excavador)

v1.76.9

sluis v1.76.9

Image	ghcr.io/truvity/sluis/sluis:1.76.9
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.9
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.9
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.9
TypeScript	@truvity/sluis@1.76.9 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.9

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.9_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.9_linux_arm64.zip,
sluis-slack_1.76.9_linux_arm64.zip, sluis-google_1.76.9_linux_arm64.zip,
sluis-cloudflare_1.76.9_linux_arm64.zip and
sluis-backup_1.76.9_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

v1.76.8

sluis v1.76.8

Image	ghcr.io/truvity/sluis/sluis:1.76.8
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.8
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.8
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.8
TypeScript	@truvity/sluis@1.76.8 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.8

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.8_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.8_linux_arm64.zip,
sluis-slack_1.76.8_linux_arm64.zip, sluis-google_1.76.8_linux_arm64.zip,
sluis-cloudflare_1.76.8_linux_arm64.zip and
sluis-backup_1.76.8_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• c619e8d: feat: a blob store reads the credential the Cloudflare module rotates (@excavador)

v1.76.7

sluis v1.76.7

Image	ghcr.io/truvity/sluis/sluis:1.76.7
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.7
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.7
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.7
TypeScript	@truvity/sluis@1.76.7 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.7

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.7_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.7_linux_arm64.zip,
sluis-slack_1.76.7_linux_arm64.zip, sluis-google_1.76.7_linux_arm64.zip,
sluis-cloudflare_1.76.7_linux_arm64.zip and
sluis-backup_1.76.7_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• dbf0a6e: feat(cloudflare): a preset can be on-demand only with store: none (@excavador)
• 667e9f0: feat(sluisctl): cloudflare token and r2 take --no-cache (@excavador)
• 56958c3: feat(deploy): external blobs can mint their credentials from a Cloudflare preset (@excavador)

Other

• 6af755d: style(deploy): wrap long lines in the blob preset code (@excavador)

v1.76.6

sluis v1.76.6

Image	ghcr.io/truvity/sluis/sluis:1.76.6
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.6
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.6
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.6
TypeScript	@truvity/sluis@1.76.6 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.6

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.6_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.6_linux_arm64.zip,
sluis-slack_1.76.6_linux_arm64.zip, sluis-google_1.76.6_linux_arm64.zip,
sluis-cloudflare_1.76.6_linux_arm64.zip and
sluis-backup_1.76.6_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 91c88d1: fix(modcall): neutralise caller-supplied values in the refusal log (CodeQL #111) (@excavador)

Other

• cc15c3d: ci: run CI as six recipe groups, with release-lint and flake reruns (@excavador)

v1.76.5

sluis v1.76.5

Image	ghcr.io/truvity/sluis/sluis:1.76.5
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.5
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.5
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.5
TypeScript	@truvity/sluis@1.76.5 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.5

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.5_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.5_linux_arm64.zip,
sluis-slack_1.76.5_linux_arm64.zip, sluis-google_1.76.5_linux_arm64.zip,
sluis-cloudflare_1.76.5_linux_arm64.zip and
sluis-backup_1.76.5_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• 0cef8a0: feat(deploy): spec, the deploy names and checks without the Pulumi SDK (@excavador)
• 2dd37d2: feat(deploy): spec.ChartSecret, one entry of the chart's secrets value (@excavador)
• eb34330: feat(audit): deploy/spec, the audit deploy names and checks without the Pulumi SDK (@excavador)

Bug Fixes

• 4d3c5ed: fix(config): keys.archive is deprecated and ignored, not long-term storage (@excavador)
• 54a3283: fix(deploy): NewBackup no longer creates the idle resume schedule (@excavador)
• 5834dc6: fix(deploy): spec.CheckVerifyKey delegates to the issuer's own key parser (@excavador)

Other

• 5ae31be: docs(chart): describe the backup example in format 2 terms (@excavador)
• 5afbabc: docs(sluis): reword the console-function and one-process wording for one function per module (@excavador)
• 18b38d6: docs(changelog): v1.76.5 entries (@excavador)
• 640f7d2: perf(lambda): flush metrics at most once a minute per instance (@excavador)
• 4dd7a4d: perf(config): remember the outcome of loading the same documents (@excavador)
• 372e688: style(memo): do not shadow the built-in max (@excavador)
• b7f73cd: docs(config): a future env layer merges above Load, so the memo key stays the document set (@excavador)
• 0ce77f4: docs(audit): name the real paths in the deploy/spec comments (@excavador)

v1.76.4

sluis v1.76.4

Image	ghcr.io/truvity/sluis/sluis:1.76.4
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.4
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.4
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.4
TypeScript	@truvity/sluis@1.76.4 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.4

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.4_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.4_linux_arm64.zip,
sluis-slack_1.76.4_linux_arm64.zip, sluis-google_1.76.4_linux_arm64.zip,
sluis-cloudflare_1.76.4_linux_arm64.zip and
sluis-backup_1.76.4_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• ce6070f: feat(policy): compile, the access-model derivation of the policy's tables (@excavador)
• 86e0ee3: feat(edge): cache the public documents at the Cloudflare edge (@excavador)
• f12e891: feat(policy): an empty rung names no lifetime in the compiled policy (@excavador)

Other

• 01883e0: style(policy): index the rung and group loops instead of copying each element (@excavador)

v1.76.3

sluis v1.76.3

Image	ghcr.io/truvity/sluis/sluis:1.76.3
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.3
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.3
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.3
TypeScript	@truvity/sluis@1.76.3 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.3

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.3_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.3_linux_arm64.zip,
sluis-slack_1.76.3_linux_arm64.zip, sluis-google_1.76.3_linux_arm64.zip,
sluis-cloudflare_1.76.3_linux_arm64.zip and
sluis-backup_1.76.3_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• b2b3a57: feat: let the backup role list the module paths it exports (@excavador)