CHANGELOG.md

# Changelog

All notable changes to AxonFlow will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

Each entry is grouped by edition: **Community** changes also ship in the
community mirror, **Enterprise** changes are EE-only.

---

## [9.9.0] - 2026-07-11 (per-user audit attribution unified + session-override forgery hardening)

**Security + correctness.** v9.9.0 unifies per-user audit attribution across all four governance planes behind an opt-in trust gate (`AXONFLOW_TRUST_IDENTITY_HEADERS`, default off), and closes a forged-identity session-override hijack — a deny→allow flip in which one governed user could apply another user's active session override — across the request-plane governance and workflow endpoints. No database migration. **Behavior change:** the planes that previously honored client-asserted identity headers unconditionally now ignore them unless the gate is on — set `AXONFLOW_TRUST_IDENTITY_HEADERS=true` on the agent (after confirming your identity source is trusted) to retain per-user attribution.

### Fixed

- **Per-user audit attribution unified across all four governance planes, behind a trust gate.** *(Community)* The client-asserted `X-User-Email` / `X-Session-Id` / `X-User-ID` headers were honored on only two of the four governance planes — MCP check-input and MCP-server `tools/call` read them unconditionally, while `/api/v1/decide` and MCP check-output ignored them entirely. The split had two consequences: PEPs that front many principals behind one org:license credential (the Claude Desktop proxy calls only decide + check-output) silently lost per-user attribution — every action attributed to the fleet service identity — and on the two planes that did read the headers, ANY governed caller could forge another principal's audit identity, including hijacking another user's active ADR-044 session override (a deny→allow flip keyed on the unvalidated header). All four planes now resolve the headers through one shared trust gate, `AXONFLOW_TRUST_IDENTITY_HEADERS` (default **off**; only the exact string `true` opts in — the same contract as the 9.8.0 gateway adapters): with the gate on, the headers attribute `audit_logs.user_email` / `session_id` on every plane, and per-user features (ADR-044 session overrides, user-scoped dynamic policies) key on that trusted identity — a forged header can never influence a verdict, authz decision, policy selection, or tenant/org resolution; with the gate off, the headers are ignored everywhere and attribution falls back to the validated identity, with a once-per-process detection warning when a request carries identity headers so an operator never silently loses attribution. Additionally, no platform-synthesized SHARED identity — the `mcp-client:<client-id>` pseudo-identity, the `<client-id>@axonflow.local` / `unknown@axonflow.local` service fallbacks, the internal-service and community-SaaS evaluator identities, or the community `local-dev` identity when asserted outside community mode — can create, be offered, or apply an ADR-044 session override on any plane; a shared identity's override would flip a deny for every caller on the client. And every orchestrator ingress that keys an ADR-044 override apply — override-create, the WCP step-gate, the MAP confirm-mode plan-execute and plan-resume, and both workflow checkpoint-resume paths (which re-evaluate a step under the checkpoint's stored actor identity) — now requires the Agent gateway's HMAC proxy token, so a caller reaching the orchestrator directly cannot forge the override identity (Community mode is exempt, matching the existing audit-tool-call enforcement). The MAP execute path additionally derives the checkpoint's actor email from the trust-gated `X-User-Email` header rather than the request body, closing a channel the header gate does not cover. Complementing that, the Agent proxy now trust-gates the per-user identity headers (`X-User-Email` / `X-User-ID` / `X-Session-Id`) on **every** proxied route rather than a per-prefix allowlist: with the gate off (default) a forged per-user identity is stripped before it can reach any orchestrator route, and the auth-derived tenant/org headers and the proxy-auth token are never touched. Advertised as the `identity_header_attribution` capability. **Upgrade note:** deployments relying on plugin-supplied identity headers must set `AXONFLOW_TRUST_IDENTITY_HEADERS=true` on the agent after confirming their identity source is trusted (MDM-managed plugin fleet, desktop proxy, gateway jwtAuth) — until then, per-user attribution, the session-summary/Claude-Code dashboards' per-session drill-down (`session_id` stays NULL on new rows), and per-user session overrides all fall back to the client-scoped identity. The previous always-trust behavior was a forgery exposure and is deliberately not preserved.

---

## [9.8.0] - 2026-07-10 (agentgateway PEP adapters, TIMESTAMPTZ retype, API-reference reconciliation)

**Minor.** v9.8.0 makes AxonFlow directly consumable as the Policy Decision Point behind an agentgateway (or any Envoy-based) data plane: a new Enterprise adapter binary serves agentgateway's three external-PDP seams — ExtMcp, Envoy ext_authz, and Envoy ext_proc — translating each into Decision Mode verdicts and engine-backed redaction with the platform's fail-closed postures intact. On the fix side, every remaining timezone-naive `TIMESTAMP` column is retyped to `TIMESTAMPTZ` (41 columns across 19 tables), closing a class of wrong-instant bugs on deployments whose database session zone is not UTC, and the published API reference (OpenAPI specs plus the Enterprise API pages) is reconciled with the shipped platform surface. One core migration (142) and one enterprise migration (133), both with down migrations and an upgrade-path test covering existing banking/SaaS databases. No SDK or plugin releases ride this train; the advertised compatibility matrix is unchanged from 9.7.0.

### Added

- **agentgateway / Envoy PEP adapters.** *(Enterprise)* A new gRPC adapter binary (`axonflow-gateway-adapters`) lets an agentgateway data plane call AxonFlow as its Policy Decision Point across all three of the gateway's external-PDP seams: `ExtMcp` (MCP `tools/call` governance with engine-mutated tool params and results), Envoy `ext_authz` (headers-only allow/deny), and Envoy `ext_proc` (streaming body inspection with engine redaction of the buffered request body and check-output governance of the response body). The adapters contain zero local policy or redaction logic — every verdict and every mutated byte comes from the engine — and enforce the platform's postures: the request plane defaults to fail-closed (the fail-open opt-in applies only to an unreachable PDP; an engine 4xx or an unfulfillable redaction obligation always blocks, and the headers-only ext_authz seam denies rather than forwards when a verdict carries a redaction obligation it cannot fulfil), while the response plane is unconditionally fail-closed, including when the engine reports redaction was not evaluated. Deny responses carry the decision and trace ids for audit correlation, inbound bearer tokens are passed to the PDP for validation, and a bounded circuit breaker fails fast per plane posture when the engine is repeatedly unreachable. Requires a PDP at platform 9.7.0 or later (the check-output `redaction_evaluated` contract). Ships in the enterprise build, with a reference agentgateway configuration covering all three seams in the runtime-e2e harness; the shared Go PEP package gains a `CheckOutput` response-governance round-trip with its wire shape pinned by contract tests.

### Fixed

- **Timezone-naive timestamp columns retyped to `TIMESTAMPTZ`.** *(Community)* 41 `TIMESTAMP` (without time zone) columns across 19 tables — sessions, API keys, gateway contexts, audit and violation logs, organizations, connectors, evidence exports, and others — stored wall-clock digits with no offset, so components reading or writing them under a non-UTC session silently shifted instants (the original symptom: gateway pre-check approvals expiring at the wrong moment on non-UTC hosts). Core migration 142 retypes the shared tables and enterprise migration 133 the five enterprise-only ones, each in a single transaction with the conversion timezone pinned to UTC regardless of the session zone, dependent views dropped and recreated around each retype — including existence-guarded handling of the banking-vertical retention views that would otherwise abort the migration on upgrades of existing banking/SaaS databases — and exact down migrations. Defensive UTC normalization is added at the confirmed local-time write sites (gateway pre-check expiry and the audit-queue writers), and the test/demo/bootstrap schema copies plus the connector registry's fallback DDL are updated to match. An upgrade-path test applies the real per-mode migration chains to an existing-release database pinned to a +05:30 session zone and asserts stored instants convert exactly and round-trip through the down migrations.
- **API reference reconciled with the shipped platform surface.** *(Community)* The four OpenAPI specs in `docs/api/` (agent, orchestrator, policy, MAS-FEAT) and the Enterprise API reference pages had drifted from the shipped code: phantom paths that never existed (unprefixed MCP check routes, top-level accuracy/conformity families, circuit-breaker activate/deactivate), missing shipped endpoints (audit session-summary, audit export and report, the OJK module, the dynamic-policies family, OTLP metrics/logs ingest, the full HITL surface), and wrong shapes (the audit-search response envelope, check-output response fields, the circuit-breaker schema). Every documented operation is now verified against handler source, the MAS-FEAT spec is re-wired into the OpenAPI CI gates it had silently dropped out of, and the agent spec is kept in lockstep with the path-template registry used by analytics (enforced by a regression test). The EU-AI-Act endpoint family the reconciliation had initially removed is restored as documented proxied endpoints — those routes are real and served through the agent's proxy to the orchestrator.

### Changed

- **The agent spec now states the single-entry-point contract explicitly.** *(Community)* `docs/api/agent-api.yaml` carries a cross-reference note that every `/api/v1/*` endpoint is reachable through the agent — the deployment's single entry point — and that endpoints the agent transparently proxies to the orchestrator are documented in `orchestrator-api.yaml`, rather than duplicating the roughly twenty proxied endpoint families into the agent spec and maintaining both copies in lockstep.

---

## [9.7.0] - 2026-07-10 (fail-closed hardening sweep, per-client version telemetry, SDK/plugin compat refresh)

**Additive minor.** v9.7.0 ships the hardening found by an adversarial end-to-end sweep of the platform, portal, and all five SDKs. The policy engine's request plane now fails closed when policies cannot be loaded, the gateway pre-check no longer executes a query it has just blocked, MCP check-output now tells a policy-enforcement point whether redaction actually ran, and the portal session drill-down that v9.6.1 enabled at the API is now reachable from the UI and honored on export. Enterprise deployments gain per-client version-distribution telemetry, and the advertised SDK/plugin compatibility matrix is refreshed: SDKs 8.5.1 (Rust 0.8.1 joins the matrix), Claude Code plugin 1.9.1, and the Claude Desktop governance proxy joins at 0.3.1. No migration.

### Added

- **Per-client version-distribution telemetry.** *(Enterprise)* Self-hosted Enterprise deployments previously had no visibility into which client versions their fleet runs — how the Claude Code plugin's version drift went unnoticed, and a total blind spot for the Claude Desktop proxy. The agent now records the validated `X-Axonflow-Client` client id + version pair on the decide and MCP check-output planes into a new Prometheus counter, `axonflow_client_version_requests_total{plane, client, client_version}`, with an `axonflow_client_version_dropped_total{reason}` companion for absent/invalid/over-cap values. Values are shape-validated and series-capped so a hostile header cannot mint unbounded label series, and the capture is telemetry-only — it is never consulted for auth or a verdict. Community builds compile the capture to a no-op and register no series. Advertised as the `client_version_telemetry` capability. The Claude Desktop proxy v0.3.1 companion release identifies itself as `mcp-proxy/<version>` on both planes.
- **Rust SDK and the Claude Desktop proxy join the `/health` compatibility matrix.** *(Community)* `/health` on both ports now advertises min/recommended versions for the Rust SDK (floor 0.7.0 — the first Rust release speaking the Decision Mode PEP contract — recommended 0.8.1) and for the Claude Desktop MCP governance proxy (floor 0.2.0 — the first release with engine-backed, unconditionally fail-closed response redaction — recommended 0.3.1), so both clients can run the same upgrade-warning gate the other SDKs and plugins already use.

### Fixed

- **The request plane now fails closed when policies cannot be loaded.** *(Community)* On a policy-load / database-unavailable error, the shared policy engine's request plane logged the failure and allowed the request through, silently disabling SQL-injection, dangerous-command, and PII-block enforcement on every request-plane gate (decide, MCP check-input, MCP resources/query and tools/execute, the gateway pre-check, and the OpenAI-compat gateway) for the duration of the outage. The request plane has no "return unprocessed content" middle ground — a request either proceeds ungoverned or is blocked — so it now blocks, symmetric with the response plane's v9.4.x fail-closed hardening, and the result carries an evaluation-error marker so an availability block is distinguishable from a policy verdict in the audit trail.
- **MCP check-output now reports whether redaction actually ran.** *(Enterprise)* `POST /api/v1/mcp/check-output` never populated the `redaction_evaluated` response field the SDKs' PEP contract depends on ("fail closed when false — the redactor did not run, so absent redacted output cannot be trusted as *nothing to mask*"). The field was always false on the wire, forcing a strict response-phase PEP to either over-block every redaction or forward output it wrongly believed had been scanned. check-output now emits `redaction_evaluated` exactly as check-input already did, restoring the advertised two-touch redaction contract.
- **The gateway pre-check no longer returns connector data on a blocked or pending request.** *(Enterprise)* The pre-check handler fetched connector data for requests it had already denied and attached the rows to the `approved:false` response — a blocked query still executed against the live connector, and a HITL-pending request surfaced data before a human approved it. The connector query now runs only for a clean-approved request; blocked, pending-approval, and approved-with-redaction outcomes return no pre-fetched data.
- **The portal session drill-down is now reachable, and exports honor the active filters.** *(Enterprise)* v9.6.1 fixed the audit-search API's `session_id` filter, but the customer portal never exposed it: the Log Explorer had no session filter input, the detail panel's Session ID was inert text, and both the portal and orchestrator export paths silently dropped `session_id` (plus `decision_id`, `policy_name`, and `override_id`) — so a session-filtered "Export" returned the tenant's entire window. The Log Explorer now has a Session ID filter with a `?session_id=` deep link, the detail-panel Session ID drills into that session, and CSV/JSON exports apply the same filter set the search does, with `session_id` as an export column.
- **Retired unavailable Anthropic model defaults.** *(Community)* A retired model id that the Anthropic API now rejects was baked into roughly a dozen fallback surfaces — compose defaults, provider-config code fallbacks, the Anthropic provider's model constants (which the unified router's failover uses), Bedrock adapter defaults, CloudFormation templates, and demo/example routers — so any provider failover through Anthropic (or the equivalent non-region-prefixed Bedrock id) failed with "all providers failed" whenever the primary provider was unavailable. Fallback ids are now centralized in a shared `llmdefaults` package pinned to current catalog ids (`claude-haiku-4-5-20251001`, and the region-prefixed `us.anthropic.claude-haiku-4-5-20251001-v1:0` on Bedrock), drift tests ban the retired ids from every named config surface, the pricing maps cover the new default ids, and both compose files now map `ANTHROPIC_MODEL` into the agent environment so the override actually reaches agent-side gateway calls.

### Changed

- **Recommended SDK and plugin versions.** *(Community)* `/health` now recommends SDK 8.5.1 for Python, TypeScript, Go, and Java (Go 8.5.1 fails closed on 4xx auth errors; Python 8.5.1 runs sync interceptors on a persistent event loop and detects AsyncOpenAI clients; TypeScript 8.5.1 authenticates `getPlanStatus`; Java was already 8.5.1) and Rust 0.8.1, plus Claude Code plugin 1.9.1 (correct on-wire version reporting) and Claude Desktop proxy 0.3.1. This also closes an agent/orchestrator drift — the orchestrator's `/health` still recommended claude-code 1.8.0 while the agent's advertised 1.9.0. Minimum-version floors are unchanged. All example projects and repo docs are swept to the 8.5.1 / 0.8.1 pins (including several stale doc pins predating 8.5.0).

---

## [9.6.1] - 2026-07-08 (patch on 9.6.0: audit-search session_id drill-down)

**Patch.** Fixes a correctness bug in the audit-search API surfaced while documenting the v9.6.0 session-summary reporting: a `session_id` filter was silently dropped, so the per-session drill-down returned the tenant's rows across all sessions instead of the one requested. Within-tenant only; tenant isolation was never affected. No migration.

### Fixed

- **`session_id` filter on `POST /api/v1/audit/search` is now applied.** *(Community)* The audit-search request handler's body-decode struct was missing the `session_id` field the query layer already supported, so a `session_id` filter was silently dropped and the session-summary "drill into this session" flow returned all of the tenant's rows across every session with a `200`. The filter now reaches the query as a parameterized, tenant-scoped condition, so drilling into a session bucket returns exactly that session's rows. Tenant scoping (from the trusted tenant header) was never affected. Pinned by a handler-level regression test and a runtime-e2e drill-down leg.

---

## [9.6.0] - 2026-07-07 (session-summary reporting API + Claude Code usage dashboard)

**Additive minor.** v9.6.0 turns the Claude Code and Cowork activity v9.5.0 began ingesting into reporting. A new session-summary API rolls governed activity into per-session (or per-user-day) buckets, additively enriched with the developer and session usage metrics when the OTLP ingest is wired; a new operator Grafana dashboard visualizes that usage; and the bundled Grafana datasources are provisioned with stable uids, closing a pre-existing bug that broke provisioned dashboards. One idempotent migration (`core/141`) auto-applies on deploy.

### Added

- **Session-summary reporting API.** *(Enterprise)* `GET /api/v1/audit/session-summary` aggregates `audit_logs` into per-session (or per-user-day fallback) buckets: request totals, an allow / block / redact breakdown, a per-tool (request-type) usage breakdown with tokens / cost / latency, and session-level totals — tenant-scoped, filterable by user, with a bucket cap (`?limit=`, default 200, max 1000) and a `truncated` flag. When the OTLP `/v1/metrics` ingest is configured, each bucket is additively enriched with the Claude Code usage metrics (lines of code, active time, commits, pull requests, tool-permission decisions, session count, and the metrics-export token and cost aggregates); the enrichment is best-effort and gracefully absent when the ingest is not wired, so the base view always works from `audit_logs` alone. In Community the endpoint returns `501` (it is an Enterprise capability).
- **Claude Code Usage Grafana dashboard.** *(Enterprise)* New dashboard `axonflow-claude-code-usage` over the v9.5.0 OTLP-ingest usage records: per-developer and per-session tokens, cost, lines of code, tool-permission decisions, and active time (PostgreSQL panels over `usage_events`), plus an ingest-health row over `axonflow_otel_ingest_rejected_total` (Prometheus). It is an operator/admin cross-org reporting surface — its org filter is a display slice, not a tenant-isolation boundary. Provisioned by the OTel/Grafana overlay and baked into the deployed Grafana image.

### Changed

- **Grafana provisioned datasources now carry stable uids** (`prometheus`, `axonflow-postgres`). *(Community)* The baked dashboards already referenced `uid: prometheus`, which the deployed entrypoint never defined — those panels resolved to "datasource not found" on a fresh deployed Grafana. Dashboards referencing datasources by name are unaffected. **Upgrade note:** a user-authored dashboard saved against the previous auto-generated datasource uid must be re-pointed once. The deployed entrypoint also accepts `USAGE_DB_*` variables so the SQL datasource can target the platform database when `GF_DATABASE_*` points at a dedicated Grafana metadata DB.

### Migration

- **`core/141`** *(Community)*: adds an idempotent `(tenant_id, timestamp, session_id)` composite index to `audit_logs` so the session-summary aggregate scans are index-assisted on large tenants. Additive — no rewrite of existing rows; auto-applies on deploy.

---

## [9.5.0] - 2026-07-06 (Claude Code & Cowork OTLP ingest: /v1/metrics, record-level identity, ingest reject visibility)

**Additive minor.** v9.5.0 completes AxonFlow's ingest of the native OpenTelemetry stream that Claude Code and Claude Cowork emit. A new `POST /v1/metrics` endpoint lands the tools' usage counters (tokens, cost, sessions, lines of code, tool-permission decisions, active time) as canonical, governed usage records; the log-ingest plane now reads the acting developer's identity and session from each record (not only the resource) so activity attributes to a real person; and both ingest planes now emit a per-tenant rejection counter and log line so a mis-configured exporter is diagnosable instead of failing silently. One idempotent migration (`core/140`) auto-applies on deploy.

### Added

- **OTLP metrics ingest (`POST /v1/metrics`).** *(Enterprise)* Claude Code and Cowork export usage as OpenTelemetry metrics (token, cost, session, lines-of-code, commit, pull-request, tool-permission-decision, and active-time counters). AxonFlow now accepts that OTLP metrics stream and lands each datapoint as a canonical `usage_events` row — delta-normalized from cumulative exports, keyed on session and developer, org-tagged from the authenticated license (never from the telemetry) — so aggregate per-developer and per-session usage reporting works over the same store the portal already reads. In Community the endpoint is present but returns 501 (it is an Enterprise capability).
- **Record-level identity on the log-ingest plane.** *(Enterprise)* The OTLP log ingest now reads `user.email`, `session.id`, and the Anthropic account identifiers from each individual log record, with a resource-level fallback — real Claude Code and Cowork exporters place these per record, not on the resource — so governed activity attributes to the acting developer instead of an anonymous placeholder. Per-developer attribution requires the client to be signed in with an Anthropic account; an API-key-only client emits no developer email, and those records remain correctly session-keyed.
- **Per-tenant ingest-reject visibility.** *(Enterprise)* Both ingest planes now emit an `axonflow_otel_ingest_rejected_total{route,tenant,reason}` counter and a log line for every rejected request, so a mis-configured or mis-authenticated exporter is diagnosable rather than appearing as a silent "zero rows, no error." Tenant labels are bounded so an unauthenticated caller cannot inflate metric cardinality.

### Fixed

- **Client control bytes in an OTLP field no longer lose an audit record or drop a metrics batch.** *(Enterprise)* A NUL or other C0/DEL control byte in a client-supplied OTLP field is valid UTF-8, so it survived the prior UTF-8 repair, but the database rejects it and would abort the insert — losing the governed audit row on the log-ingest plane, and rejecting the entire export batch (including every well-formed sibling datapoint) on the metrics plane. Every client-supplied string that reaches storage on either plane is now sanitized — control bytes stripped, ordinary prose whitespace preserved — before persistence.

### Migration

- **`core/140`** *(Community)*: adds nullable OTLP usage columns and three partial indexes to `usage_events` to back the metrics-ingest records above. Additive — no rewrite of existing rows, and a no-op for the new columns until Enterprise OTLP metrics ingest writes them. Auto-applies on deploy.

## [9.4.0] - 2026-07-03 (capability-scoped detection, documentation false-positive hardening, fresh-deploy and audit fixes)

**Additive minor.** v9.4.0 sharpens detection so governed documentation workflows stop tripping execution-oriented detectors, while keeping every real attack governed. Execution-class detectors (SQL injection, dangerous commands) now skip tools whose input is prose rather than executable statements, the loose-verb and comment-based SQL-injection detectors are hardened against documentation text, and several fixes close a self-blocking override path, an empty signed decision chain, a response-plane fail-open on a policy-load error, and portal display and fresh-deploy issues. Three idempotent migrations (`core/135`, `core/138`, `core/139`) auto-apply on deploy.

### Added

- **Capability-scoped policy evaluation.** *(Community)* Execution-class detectors (SQL injection and dangerous-command families) no longer evaluate tools positively classified as text-document tools (documentation editors whose input is prose, not executable statements), so legitimate documentation edits are no longer blocked as though they were code or SQL. Classification happens server-side against a built-in registry and is never taken from an untrusted caller; unknown or unclassified tools get full evaluation (fail-closed), and content-borne families (all PII, sensitive-data, compliance, and prompt-injection guards) evaluate everywhere, including for text-document tools. The `AXONFLOW_CAPABILITY_SCOPING_DISABLED` kill switch restores full evaluation on every tool in both editions. Enterprise deployments can extend the built-in registry with additional tool names via `AXONFLOW_TEXT_DOCUMENT_TOOLS`.
- **Per-category detection corpus gate.** *(Community)* A labeled per-category detection corpus (attack and benign cases) now scores recall on attacks and false-positive rate on benign input in CI, so a change that raises false positives or weakens recall on a governed category fails the build.

### Fixed

- **Documentation text no longer trips the loose-verb, agent-config, and IP detectors.** *(Community)* Several false-positive-prone detectors matched plain English and Markdown as though it were executable input. The SQL-injection detectors for authentication bypass and for `GRANT` / `REVOKE` / `DROP` / `CREATE USER` now require SQL grammar (a quote or paren breakout, or a privilege-and-object clause) instead of a bare English verb; the dynamic-code-execution detector requires call syntax so a hyphenated identifier no longer matches; the agent-config-file detector requires a write or execute context rather than a filename mentioned in prose; and RFC-special and documentation IP ranges (for example the `0.0.0.0/0` allow-all shorthand in a hardening note) are no longer flagged as a person's address. Each replacement pattern is narrower than the one it replaces, so real attacks stay governed, proven by a paired attack corpus.
- **Comment-out SQL-injection authentication bypass is now detected.** *(Community)* The classic comment-out bypass (a string-literal terminator followed by a SQL line comment that comments out the rest of a `WHERE` clause, for example `admin' --`) passed clean through every governed input plane, because the existing comment detectors required a SQL keyword after the comment. A new detector matches a breakout string terminator directly followed by a line comment that ends the line, gated so ordinary quoted arguments and documentation prose (a balanced quoted token, or a comment carrying trailing text) do not match.
- **Override justification no longer blocks its own override request.** *(Community)* A policy-override request whose justification quoted the very content it was overriding was blocked by that justification, making some overrides impossible to submit. The override metadata is now exempt from content evaluation on the governance override tool only; the same content in the override's target scope, or on any other tool, is still evaluated normally.
- **Response-plane now fails closed on a policy-load error.** *(Community)* When the policy engine could not load its policies while processing a response, the response plane failed open and let the content through. It now fails closed on a policy-load error, matching the request plane.
- **Signed decision chain is no longer silently empty.** *(Community)* The non-repudiation decision chain stored no rows at all: the parent request identifier was written through a failing type cast, so every chain-record insert failed (silently, since the write is best-effort). The cast is fixed, so signed decision chains now persist and capture their parent references.
- **Portal fixes: in-VPC deployment mode, policy count, synthetic-identity affordance, and more.** *(Enterprise)* A sweep of customer-portal fixes: the portal now honors the in-VPC enterprise deployment mode, the dashboard shows the unified total policy count rather than the dynamic-only count, the audit Log Explorer gains a synthetic-identity affordance, and a further set of display and data-loading issues across the portal are resolved.

### Migration

- **`core/135`** *(Community)*: hardens the false-positive-prone SQL-injection and dangerous-command detector patterns (pattern-row updates via a new migration; shipped migrations stay immutable). Each update is guarded on the original seeded pattern, so a tenant-customized row is never clobbered. Auto-applies on deploy.
- **`core/138`** *(Enterprise)*: re-applies the v9 `org_id` and row-level-security completion for enterprise tables created by later-numbered migrations (SSO and connector-config tables), which on a fresh enterprise deploy came up without `org_id` or their RLS policies, and additionally allows `redact` as an override action. Every step is guarded and idempotent: it is a no-op on upgraded deploys where the tables already carried the columns, and on community deploys where the tables do not exist. Auto-applies on deploy.
- **`core/139`** *(Community)*: seeds the comment-out SQL-injection detector row (`security-sqli`, warn base action). Idempotent insert; auto-applies on deploy.

## [9.3.1] - 2026-07-02 (patch on 9.3.0)

**Patch.** Two fixes on top of [9.3.0]: policy action override and organization-tier static-policy creation now work for deployments whose organization id is not UUID-shaped, and the customer-portal audit Log Explorer now shows the matched policy on redact/block rows. No new behavior; one idempotent migration (`core/133`) that auto-applies on deploy. See the 9.3.0 entry below for the feature release.

### Fixed

- **Policy override and organization-tier static-policy create no longer 500 for non-UUID organization ids.** *(Community)* AxonFlow organization ids are free-form strings sourced from the signed license, not UUIDs. Four policy tables (`static_policies`, `dynamic_policies`, `policy_overrides`, `policy_evaluations`) carried a legacy `organization_id` column typed `uuid`; binding a non-UUID org id into it failed with `invalid input syntax for type uuid`, which surfaced in 9.3.0 as a hard 500 on the policy action override create path (`POST /api/v1/static-policies/{id}/override`) and on organization-tier static-policy create (`POST /api/v1/static-policies` with `tier: organization`). Migration `core/133` retypes `organization_id` to `text` on all four tables, and `HandleCreateOverride` now scopes the override by the canonical varchar `org_id` plus `tenant_id`, leaving the legacy column NULL. The `valid_override_scope` CHECK constraint, the partial indexes on `organization_id`, and row-level security (which keys on `org_id`) are all type-transparent across the retype. `org_id` is the canonical organization column and RLS key; the legacy `organization_id` remains deprecated and is scheduled for removal.
- **Portal audit Log Explorer shows the matched policy on redact and blocked rows.** *(Enterprise)* The customer-portal audit Log Explorer's Policy column and detail panel rendered blank on PII-redact and blocked rows, because the matched policy is nested in `policy_details` (a `policy_names` array plus `policy_matches` on blocks, and `policy_ids` only on PII redacts) and was never lifted for display. The portal now lifts the human policy name across every shape (scalar, `policy_names` string or array, and all `policy_matches[*].policy_name` joined) and falls back to the matched policy ids on redact rows that carry no name, so a genuinely-matched row is never rendered blank.

### Migration

- **`core/133`** *(Community)* — retypes the legacy `organization_id` column from `uuid` to `text` on the `static_policies`, `dynamic_policies`, `policy_overrides`, and `policy_evaluations` tables. Idempotent and guarded: it only alters a column still typed `uuid`. The retype is a full table rewrite, but the affected tables are small, bounded configuration tables, so it completes near-instantly. Auto-applies on deploy; no operator action required.

## [9.3.0] - 2026-07-02 (audit visibility: per-developer + per-session identity, audit read/report/export API, portal Log Explorer)

**Additive minor.** v9.3.0 makes governed activity visible end to end: per-developer and per-session identity now flows through to the canonical audit row, a read/report/export API exposes the audit trail, and the customer portal gains a filterable, expandable Log Explorer. Claude Code traffic is brought into the same governed view via a Grafana dashboard and OpenTelemetry ingest. One additive migration (`core/129`); the new endpoints are backward-compatible and the remaining changes are behavior-preserving fixes.

### Added

- **Per-developer and per-session identity through to the canonical audit row.** *(Community)* Requests carrying `X-User-Email` and `X-Session-Id` now propagate that identity into `audit_logs`, so every governed decision can be attributed to the developer and session that produced it. Migration `core/129` adds the nullable `audit_logs.session_id` column; the user email lands on the existing identity columns.
- **Audit read / report / export API.** *(Community)* New read-only endpoints expose the audit trail: `GET /api/v1/audit/{id}` returns a single decision record, `POST /api/v1/audit/report` returns per-action counts and top policies for a filter, and `POST /api/v1/audit/export` streams the filtered rows (with a truncation header when a row cap is reached). Redacted values are served as stored — there is no unmask path.
- **Portal audit-logs Log Explorer.** *(Enterprise)* The customer-portal Audit Logs page is rebuilt as a Log Explorer: combinable filters (user email, action, tenant, date range) with pagination, per-row expansion to the full decision record, a report-by-action view, and export of the active filter. Redacted content is rendered as stored and labelled.
- **Claude Code Grafana dashboard and decision origin label.** *(Community)* A new Grafana dashboard visualizes Claude Code governed traffic, and decisions now carry a bounded `origin` metric label (with obligations and blocks series) so decision volume can be sliced by call origin without unbounded cardinality.
- **Cowork / Claude Code OpenTelemetry ingest to canonical `audit_logs`.** *(Enterprise)* An authenticated `POST /v1/logs` endpoint lands Cowork and Claude Code OpenTelemetry log events as canonical `audit_logs` rows (`plane=cowork` / `plane=claude_code`), so agent activity from those hosts is a first-class audit source rather than a satellite table. The ingest is a force-redact storage plane: PII is masked before the row is stored, and it fails closed (withholds the row) when detection is unavailable.
- **Unified policy write dispatcher.** *(Enterprise)* A single `/unified-policies/*` write path now dispatches policy create/update/delete across the system and tenant policy stores, replacing the scattered per-store write handlers.

### Fixed

- **Portal Usage reflects governed Claude Code traffic.** *(Enterprise)* The portal Usage page under-counted governed activity because Claude Code MCP traffic was not attributed to the usage rollup; it now surfaces that traffic.
- **Grafana agent and orchestrator blocked/allowed panels use the real metric names.** *(Community)* The agent and orchestrator dashboards referenced defunct synthetic-exporter series, so the blocked/allowed panels were empty; they now query the real emitted metric names.
- **Policy action override on the static / system path.** *(Community)* The policy action override now applies on the static (system) policy path: it authenticates through the proxy, reads back via the agent `GET`, and keys on `policy.id`, with an allow-flip guard. The redundant dynamic-override path is removed — action override is a system/static-only capability (dynamic policies are edited or deleted directly).
- **Cross-tenant static-policy read/write isolation.** *(Community)* Static-policy reads and writes are now scoped to the caller's tenant, closing a path where one tenant could read or write another tenant's static policies.
- **Executions and Approvals no longer 500 on NULL columns.** *(Community)* The executions list and the approvals list / approve / reject paths failed to scan rows with legitimately-NULL columns (for example a MAP-plan row with a NULL `source`, or workflow-step rows with NULL identity or step fields); those scans now tolerate NULL.
- **SSO setup flow.** *(Enterprise)* The portal SSO page treated a "not configured" backend response as already-configured and never showed the provider selector; the setup flow now renders correctly.
- **SCIM and SSO modal z-index.** *(Enterprise)* The SCIM token and SSO confirmation modals sat beneath their own backdrop, leaving their buttons unclickable; the modal panels are now layered above the backdrop.
- **Compliance evidence export no longer drops audit rows.** *(Enterprise)* The compliance evidence export selected columns that do not exist on the audit row, dropping every `audit_logs` entry from the export; it now derives the blocked flag from the policy decision and the risk score from the stored decision details, and includes the rows.

### Migration

- **`core/129`** *(Community)* — adds the nullable `audit_logs.session_id` column (additive; existing rows and existing callers are unaffected).

## [9.2.2] - 2026-07-01 (patch on 9.2.1)

**Patch.** Three fixes on top of [9.2.1]: the MCP `check_policy` advisory tool now redacts PII on its allow path, the Java example dependencies clear three Jackson CVEs, and an internal license-generation doc is corrected. No new behavior and no migrations; see the 9.2.0 entry below for the feature release.

### Fixed

- **`check_policy` now runs PII detection on the allow path.** *(Community)* The MCP `check_policy` advisory tool returned `allowed: true` without running input PII detection, so a write call carrying an Indonesian NIK (or other PII) could execute with raw PII before the host model had a chance to retry. It now runs the same input redaction as the `check-input` PEP gate and, when redaction fires, returns `requires_redaction: true` plus a `redacted_statement`, so a PEP/plugin (for example `pre-tool-check.sh`) denies the first call and retries with engine-masked content before raw PII reaches the tool. A latent nil-pointer dereference in `evaluateInputPolicies` on the fail-closed path — engine `Blocked` with `BlockedBy` nil when the database is unavailable and `GracefulDegradation=false` — is also guarded.
- **Jackson bumped to 2.22.0 across the example poms.** *(Community)* `jackson-databind` resolved to a version affected by CVE-2026-54512 / CVE-2026-54513 (HIGH) and CVE-2026-54515 (MEDIUM) across the Java examples; 2.22.0 is the lowest published version clear of all three jackson CVEs at CRITICAL/HIGH/MEDIUM. The pins cover the `examples/` and `ee/examples/` poms (literal versions and the `jackson.version` / `jackson-bom.version` properties), with explicit `jackson-databind` overrides added to the gateway-mode and spring-boot examples that previously pulled it transitively via the OpenAI client. `**/pom.xml` is also added to the security-scan path filters so a Maven dependency CVE now blocks a PR instead of only turning the nightly scheduled scan red.
- **Corrected a stale build command in the internal license-generation doc.** *(Enterprise)* The internal license-generation workflow doc (under `technical-docs/`, excluded from the community sync) described the deprecated V1 build — omitting `-tags enterprise` and building from `platform/` instead of the `ee/` module — which produces a binary that emits and validates stale keys. It now documents the correct `-tags enterprise` build from the `ee/` module and points to the canonical generation runbook.

### Changed

- **`/health` now advertises Claude Code plugin 1.7.0 as the recommended version.** *(Community)* The `RecommendedPluginVersion["claude-code"]` value reported by the agent and orchestrator `/health` capability blocks is bumped 1.6.0 → 1.7.0 to ride this patch; the recommended openclaw (2.6.6), cursor (1.5.3), and codex (1.5.2) versions, and every minimum-version floor, are unchanged.

## [9.2.1] - 2026-06-23 (patch on 9.2.0)

**Patch.** A consistency fix on top of [9.2.0]; see the 9.2.0 entry below for the feature release.

### Fixed

- **Audit-verification endpoints registered in path normalization.** *(Community)* The three audit-verification endpoints added in 9.2.0 (`/api/v1/audit/chains/{chainID}/verify`, `/api/v1/audit/records/{recordID}/verify`, `/api/v1/audit/signing-key`) were present in the OpenAPI spec but missing from the request-path template table, so the spec/template consistency check (`TestTemplatesMatchAgentAPISpec`) failed and those paths were not normalized for telemetry roll-up. They are now registered. Routing and behavior were unaffected.

## [9.2.0] - 2026-06-23 (read-only MCP posture, tamper-evident audit signing, turnkey SIEM export, compliance-category enforcement)

**Additive minor.** v9.2.0 hardens governance and audit assurance: a one-config read-only MCP posture, a connector-level database backstop, per-record cryptographic signing of the decision chain (now capturing live traffic) with read-only verification endpoints, a turnkey central-store / SIEM audit exporter, and automatic cross-border `transfer_basis` stamping on the canonical audit row. **Two behavior changes to note (both in Fixed):** the seeded RBI / SEBI / MAS-FEAT / EU-AI-Act compliance policies now actually fire on `/decide` and the gateway (they were silently excluded by a category-spelling mismatch), and a tool/connector response carrying an indirect prompt-injection pattern is now sanitized by default on the response plane (the statement carrying the injection is removed). Everything else is additive and off by default.

### Added

- **Read-only MCP enforcement posture: one config flag blocks every write-path MCP call.** *(Community)* Setting `MCP_READ_ONLY=true` (env, default off) blocks write-intent MCP calls across all connector-execution planes: the `check_policy` advisory tool, the `check-input` PEP gate, `tools/execute`, `resources/query`, and the gateway pre-check. A method-name verb classifier (`classifyMCPCall`) handles tool-call intent, and a SQL statement classifier (`statementIsWritePath`) handles the raw-statement query plane: it masks string literals and comments, rejects stacked statements and dollar-quoted bodies, and catches `SELECT ... INTO` and `EXPLAIN ANALYZE <dml>`, failing closed on anything it cannot prove read-only.
- **Connector-level read-only database transaction backstop.** *(Community)* A new per-call `base.Query.ReadOnly` field lets a connector run a read inside a database-enforced read-only transaction. The PostgreSQL connector honors it by opening `BEGIN READ ONLY`, so the database itself rejects (SQLSTATE `25006`) any write that a statement classifier might miss; it is the durable backstop under the read-only MCP posture above. Byte-identical behavior when the flag is off (no extra round-trip, no transaction). MySQL and Snowflake can adopt the same flag in a follow-up; Cassandra has no read-only-transaction primitive and stays verb-path only.
- **Tamper-evident audit signing + read-only verification endpoints.** *(Community)* Each decision-chain record is now signed with a per-record Ed25519 signature and linked by a `prev_hash` hash chain with a monotonic `chain_seq`, appended race-free under an advisory lock (migration `core/125`). A single record can be verified standalone offline: the response republishes the digest pre-image, record digest, prev_hash, and chain hash so an auditor can recompute and re-verify trusting neither the endpoint nor its digest. Three new read-only endpoints (documented in `docs/api/agent-api.yaml`): `GET /api/v1/audit/chains/{id}/verify` (linkage + every signature, with an `authorship_proven` flag for the strong non-repudiation claim), `GET /api/v1/audit/records/{id}/verify` (one record standalone), and `GET /api/v1/audit/signing-key` (publish the current public key). Signing key and retired-key rotation are configured via `AXONFLOW_AUDIT_SIGNING_KEY` (+ optional `AXONFLOW_AUDIT_SIGNING_KEY_ID`) and `AXONFLOW_AUDIT_VERIFY_KEYS`; when no key is set, records are hash-chained but reported honestly as unsigned.
- **Decision-chain signing now captures live traffic.** *(Community)* The production decision-chain tracker is now a writing instance: real `/decide`, OpenAI-compatible, gateway pre-check, and early-deny decisions are enqueued and signed + hash-chained off the request hot path by async workers (the same instance still backs the verify endpoints, so a record signed here verifies against the keys loaded here). Previously the tracker was instantiated verify-only, so no production decision was ever signed. A `/decide` redaction signs as `approved` (an obligation on an `allow` verdict per the decide → fulfill contract); only the gateway plane records a `redacted` → modified verdict.
- **Turnkey central-store / SIEM audit exporter.** *(Community)* A new exporter ships each decision to an external store off the decision hot path (non-blocking queue with timeout and circuit breaker), so a denied or redacted decision can land in a customer's SIEM or object store without touching request latency. Enabled via `AXONFLOW_AUDIT_SINK=s3` (default empty = disabled; decision path byte-for-byte unchanged when off), with `AXONFLOW_AUDIT_S3_BUCKET` / `AXONFLOW_AUDIT_S3_PREFIX` / `AXONFLOW_AUDIT_S3_REGION` / `AXONFLOW_AUDIT_S3_ENDPOINT` / `AXONFLOW_AUDIT_S3_PATH_STYLE`. Shipped, dropped, failed, and skipped records are metered on `axonflow_central_store_records_total`.
- **Automatic cross-border `transfer_basis` stamping on the canonical audit row.** *(Enterprise)* The orchestrator now auto-stamps the UU PDP Pasal 56 cross-border transfer basis (and derived data-residency) onto the canonical `audit_logs` decision row (columns added in migration `core/126`), resolved per-request, then per-org via `AXONFLOW_ORG_TRANSFER_BASIS`, then a global `AXONFLOW_DEFAULT_TRANSFER_BASIS`, so Pasal 56(b) attestation is turnkey rather than hand-stamped.

### Fixed

- **Indirect prompt-injection is now governed on the response / tool-output plane.** *(Community, behavior change)* The four indirect prompt-injection patterns (instruction-override, role-reassignment, system-prompt exfiltration, and template/bracket markers; migration 116) were seeded `phase='request'`, so `evaluateOutputPolicies` never evaluated them: a malicious instruction returned in a connector free-text field (for example a back-office CRM note) re-entered the model's context ungoverned, even though the response plane already covered SQL-injection, PII, and sensitive-data. Migration `core/128` flips those four `sys_dangerous_injection_*` policies to `phase='both'` and sets their previously-NULL `action_response` (the request-plane action stays `block`), and a new `EnabledSecurityDangerousCategories` helper folds the security-dangerous category into the response evaluation set (the phase flip alone is inert, because `filterByCategories` would otherwise drop the category). Only the injection patterns are promoted; the dangerous-command patterns (migration 059: reverse shell, `/etc/passwd`, `eval()`, credential-file access) stay request-only by design, since matching a command description against connector output would hard-block benign data. **The default response-plane action is redact (sanitize):** the sentence/line/clause containing the injection is removed (JSON-aware, preserving valid structure and sibling fields), so no injectable instruction reaches the model, while surrounding legitimate data passes through, overridable per-org to warn or block via the detection-posture override; the input plane still blocks. The outcome is recorded as a canonical `plane=mcp` response audit row. **Behavior change:** a tool/connector response carrying one of these injection patterns now has the injection-bearing statement removed by default.

- **Seeded compliance policies now enforce on `/decide` and the gateway.** *(Community, behavior change)* The seeded RBI, SEBI, MAS-FEAT, and EU-AI-Act compliance policies stored drifted category spellings (`rbi_compliance`, `sebi_compliance`, `mas_feat_compliance`, `eu_ai_act_compliance`) that did not match the canonical category constants (`compliance-rbi`, `compliance-sebi`, `compliance-masfeat`, `compliance-euaiact`). Because the decision filter matches category exactly, those rows were silently excluded and the policies never fired. The industry seeds are canonicalized at source for fresh deployments, and a forward-fix migration (`core/127`, plus `core/014` for EU) realigns existing deployments. **Behavior change:** deployments seeded with these compliance packs will start enforcing them on `/decide` and the gateway.
- **Matched policies surface the policy name, not an opaque UUID.** *(Community)* The orchestrator's active-policy cache is keyed by `policy_id` to avoid cross-tenant name collisions, but `ListActivePolicies` copied that key into the policy's `Name`, so `matched_policies` reported a UUID. It now reads the stored policy name.
- **The OJK cross-border export reads the canonical audit row.** *(Enterprise)* The Indonesian OJK cross-border export is repointed to read the canonical `audit_logs` decision row carrying the stamped `transfer_basis`, consolidating it onto the same source as the rest of the compliance exporters.

### Security

- **`golang.org/x/net` and `golang.org/x/crypto` bumped to clear Trivy HIGH advisories** (`x/net` 0.52 → 0.56, `x/crypto` 0.49 → 0.53) across the flagged modules, restoring a green repo-wide vulnerability scan. Dependency-only; no code or behavior change.

## [9.1.1] - 2026-06-16 (security patch: container CVE, CodeQL hardening, IaC encryption)

**Security-only patch.** No feature or behavior changes. Remediates the high and critical findings from the 2026-06-16 security sweep (epic #2711).

### Security

**Community.**

- **Base image: OpenSSL/libssl3 bumped past CVE-2026-45447.** The agent and orchestrator runtime images now run `apk upgrade libssl3 libcrypto3` so the layer ships OpenSSL >= 3.5.7-r0 (was 3.5.6-r0). A local Trivy rescan confirms the container CVE is gone.
- **Reflected-XSS hardening on the HTTP response paths.** The community-SaaS recovery confirmation page now renders through `html/template` (contextual auto-escaping) instead of `fmt.Sprintf` with a hand-rolled escaper; the transparent response-writer wrappers (idempotency replay, transparency headers, telemetry status capture, customer-portal request logging) now set `X-Content-Type-Options: nosniff` so a reflected value cannot be MIME-sniffed as HTML.
- **Session identifiers are masked in logs.** The MCP server handler now logs only a short prefix of session IDs (bearer-style handles), never the full value.
- **Path-injection guard on the cross-system HITL webhook test harness.** Dump filenames are restricted to a flat token, so a crafted `approval_id` cannot traverse outside the dump directory.

**Enterprise / infrastructure.**

- **Alert SNS topics are now encrypted with a customer-managed KMS key.** The alarm, first-payment, and synthetic-monitoring alert topics use a CMK whose key policy grants exactly the CloudWatch alarm service / canary Lambda the publish permissions they require.
- **New gitleaks CI workflow.** Runs the existing `.gitleaks.toml` rules on every PR/push commit delta, complementing the pre-commit hook and GitHub push-protection. The esbuild dev-dependency in the MCP-policies example was bumped to 0.28.1.

## [9.1.0] - 2026-06-12 — Audit coverage made permanent, policy-inventory truth, a portal policy-display fix, and the sensitive-data lever now enforced

**Community.** v9.0.0 converged every enforcement plane onto one canonical audit vocabulary and closed the then-known early-return-deny holes by hand. v9.1.0 makes that coverage **durable** instead of a recurring pre-release sweep: a deterministic CI gate now fails the build whenever a Policy Enforcement Point's deny path doesn't write a canonical `audit_logs` row, the last remaining agent-plane gaps are closed (so the gate reports zero deferred exceptions), the built-in policy inventory is pinned to a single source of truth, a customer-portal bug that silently hid most seeded system policies is fixed, and the `sensitive-data` governance lever — long documented but inert — now actually enforces. **One behavior change to note:** the `strict` and `compliance` profiles now BLOCK credential/secret detections that previously only logged (see Fixed); set `SENSITIVE_DATA_ACTION=log` to retain the prior behavior. The audit and inventory changes are otherwise additive; a single data migration realigns a legacy sensitive-pattern phase column to the active action with no behavior change.

### Added

- **A deterministic audit-coverage CI gate that ends the recurring "this deny path forgot to audit" surprises.** A new test walks every non-test `.go` file under `platform/` and `ee/platform/`, resolves from the parsed AST every function that calls the policy decision engine (`EvaluateRequest` / `EvaluateResponse` / `EvaluateDynamicPolicies` / `EvaluatePolicy` / `EvaluateStepGate` / `EvaluateMCPPermission` / `EvaluateWithGracefulDegradation`, plus a one-hop set of in-tree policy-delegating helpers), and fails the build if any such enforcement point's deny path doesn't write a canonical row through a blessed audit writer. Every conscious exception lives in a checked-in, reviewed allowlist with a one-line reason — `BY-DESIGN` (engine-internal / adapter / dry-run whose audit is the caller's responsibility, with the auditing caller named) or a tracked deferred gap. This replaces the hand-run coverage sweeps that historically found a fresh batch of holes only after they shipped. The gate's known structural limits — single-hop helper resolution and single-deny-per-function detection — are documented.

### Fixed

- **Every Policy Enforcement Point now audits — the gate reports zero deferred exceptions.** The last agent-plane gaps the new gate flagged are closed so a denied request can no longer return before recording its decision:
  - **Agent `/api/request` denials write a canonical `plane=agent` row.** The agent proxy's terminal denials (circuit breaker, static / tenant policy, HITL gate, budget) previously landed only in the reader-less legacy `agent_audit_logs` table, so an agent-side block was invisible in the portal `/decisions` feed and the compliance exporters. Each deny now also writes a canonical `audit_logs` row via the established decision writer, keyed on the authenticated user / tenant.
  - **The MCP service-license permission gate audits its `403`.** An authorization failure now writes a canonical `plane=mcp` `blocked` row, keyed on the authenticated request identity (never the service-license deployment id, which is the licensee — not a customer tenant); the license key is never passed to the writer.
  - **The legacy in-memory HITL engine audits a fail-open policy-check error.** When the optional in-memory HITL gate's policy check itself errors, the engine still fails open for availability, but the errored governance verdict is no longer lost — it writes a canonical `error` `step_gate` row instead of being silently treated as an allow.
- **The `sensitive-data` governance lever now actually enforces — on both the request and response planes.** *(Community)* The built-in sensitive-data system policies (credentials, tokens, secrets, connection strings) resolved to a hardcoded `log` regardless of `AXONFLOW_PROFILE` or `SENSITIVE_DATA_ACTION` — the documented `default=warn` / `strict=block` posture was a no-op. Sensitive-data is now wired into the action-override map (mirroring SQL-injection and PII) and evaluated on every request plane and the response plane, so the profile and env lever drive it.
  - **⚠️ Behavior change:** the **`strict` and `compliance` profiles now BLOCK** sensitive-data detections that previously only `log`ged, and the **`default` profile now WARNs** (was `log`) — on **both the request and response planes** (a credential-shaped LLM response is withheld under strict/compliance). This matches the long-documented [Governance Profiles](https://docs.getaxonflow.com/docs/guides/governance-profiles/) matrix and the [System Policies](https://docs.getaxonflow.com/docs/policies/system-policies/) reference. A deployment running `AXONFLOW_PROFILE=strict`/`compliance` will start blocking content carrying credentials/secrets. Set `SENSITIVE_DATA_ACTION=log` (or `=warn`) to retain the prior pass-through behavior.
- **Three privileged mutations that were unaudited now write a persistent, secret-free audit row.** Reusing the established writers (no new table):
  - **SCIM bearer-token mint / revoke.** *(Enterprise)* Token create / revoke now emit an `admin_audit_log` event on every outcome, keyed on the session tenant; the row carries only the token id / display prefix / name through an allowlist — the minted plaintext value and its hash structurally cannot be logged.
  - **Deployment upgrade trigger.** *(Enterprise)* The portal's trigger-upgrade endpoint now audits every post-auth outcome (validation / lookup / cloud-API failures and the terminal success / partial / all-failed result) with the session org, initiator, and targeted service; a decode failure is recorded with a fixed label, never the request body.
  - **Legacy in-memory HITL gate verdicts.** A `block` / `require_approval` verdict from the optional in-memory HITL engine now emits a canonical `step_gate` `audit_logs` row.
- **The customer-portal Policies page now shows all seeded system policies instead of silently dropping them.** *(Enterprise / Community)* The unified-policies view fetches the seeded **system** (static) policies from the agent over an internal-service-authenticated call. Both `docker-compose.yml` and `docker-compose.enterprise.yml` defaulted the shared internal-service secret to empty, so on a local / evaluation **enterprise** stack the agent rejected the unauthenticated call with a `401`, and the portal handler silently dropped every static policy — leaving a short list (≈17) that looked complete. The compose files now default that secret to a shared local-dev value across the agent, orchestrator, and portal (real deployments still inject their own secret), and the list / summary / effective unified-policies endpoints now return an additive `partial` flag with `source_errors` so a degraded policy view is never presented as complete.

### Changed

- **The built-in policy inventory has a single source of truth: the migrations.** *(Community)* A dead, never-consumed in-code seed file (`platform/agent/system_policies_seed.go`) that advertised a phantom 106-policy count — and caused confusion about the real number — is deleted, along with the four test files that solely exercised it. The authoritative inventory is now pinned by a red-on-revert real-Postgres test against a fully-migrated database: **79 immutable system policies** (69 static + 10 dynamic), **103 enabled out of the box** (any tier), **112 seeded** rows total. Stale count comments and references to the deleted file were corrected. No runtime behavior change — the deleted Go definitions never reached the database or the engine.
- **A legacy sensitive-pattern phase column realigned to the active action.** *(Community)* A data migration realigns the per-phase action column on the built-in SQL-injection system policies to match their already-relaxed base action, so the stored value no longer contradicts the runtime posture (which is profile-driven). No behavior change — the runtime already used the profile/override action; this removes a stale column that misrepresented the default posture.

### CI / Internal

- **The audit-coverage gate runs as a dedicated, DB-free CI job** wired into the test summary, so every change that adds or moves an enforcement point is checked automatically.

## [9.0.0] - 2026-06-12 — Canonical audit vocabulary: one decision spelling across every plane, enforced at the database

**Community.** v9.0.0 completes the audit-trail consolidation begun in v8.7.0: every enforcement plane now writes the **same canonical `policy_decision` vocabulary**, a database `CHECK` constraint makes a non-canonical write fail loudly, and every reader — the decisions feed, the audit summary, and the SEBI / EU AI Act compliance exports — consumes that vocabulary through one shared normalizer. The audit-coverage work also closes the remaining early-return-deny holes on the MCP, gateway, `/decide`, and control-plane surfaces, so a denied request can no longer slip through unaudited. This is a **major release** because the canonical-verdict cutover changes externally-observable values: the `policy_decision` an integrator reads back, the `decision` filter the `/decisions` API accepts, the outcome strings in regulator-facing exports, and the status of a timed-out HITL approval. See the [v8 → v9 migration guide](https://docs.getaxonflow.com/docs/deployment/v8-to-v9-migration/) for the full impact analysis and upgrade steps. The decision-record convergence this release executes is specified in [ADR-058](technical-docs/architecture-decisions/ADR-058-unified-audit-decision-log.md).

### Breaking changes at a glance

- **`policy_decision`** values are canonicalized and DB-`CHECK`-enforced — `allow`→`allowed`, `deny`/`denied`→`blocked`, `pending_approval`→`needs_approval`.
- **`/decisions?decision=`** rejects the legacy `allow` / `deny` / `require_approval`; filter on `blocked` / `needs_approval` (historical rows still match).
- **SEBI / EU AI Act export outcomes** canonicalized — `allowed`→`approved`, `needs_approval`→`pending_review`. *(Enterprise)*
- **HITL timeout status** — `rejected` → `expired`.

### ⚠️ BREAKING CHANGES

- **`policy_decision` is canonicalized to a single vocabulary, enforced by a DB `CHECK`.** Every writer now persists one of `allowed` · `blocked` · `redacted` · `needs_approval` · `error` (plus the non-verdict marker `override_lifecycle`), and migration `core/123` adds a `CHECK` constraint on `audit_logs.policy_decision` that rejects anything else.
  - **Old → new:** the agent `/decide` writer previously persisted the wire verdicts `allow` → now `allowed` and `deny` / `denied` → now `blocked`; the orchestrator workflow gate previously wrote `pending_approval` → now `needs_approval`. Migration `core/122` backfills the historical `allow` / `deny` / `denied` rows and `core/123` normalizes any residual divergent spelling (an unrecognized value fails **safe** to `error`, never `allowed`) before adding the constraint, so existing history is preserved and uniform.
  - **Impact:** any consumer that reads `audit_logs.policy_decision` directly (or the `decision` field of the `/decisions` list / `/explain` responses) must expect the canonical spellings. A custom writer that inserts a non-canonical value will now be rejected by the database.
- **The `/decisions?decision=` filter is validated against the canonical vocabulary.** The endpoint now accepts the canonical set (including `needs_approval`, which the old `allow` / `deny` / `require_approval` allowlist rejected with a `400`) and **returns `400` for the legacy / phantom spellings** `allow`, `deny`, and `require_approval`. The SQL still expands each canonical value to every historical spelling it covers, so a filtered query matches legacy rows. **Old → new:** filter on `blocked` (was `deny`) and `needs_approval` (was `require_approval`).
- **SEBI and EU AI Act export outcomes use the canonical-derived strings.** *(Enterprise)* Both exports now run each raw `policy_decision` through the shared normalizer before mapping it to a regulator-facing outcome, closing a leak where a raw `allowed` reached the export un-mapped. **Old → new:** `allowed` → `approved`, `needs_approval` → `pending_review` (a human-deferred decision is flagged as requires-review, never silently downgraded to `approved`).
- **A timed-out evaluation-tier HITL approval is recorded as `expired`, not `rejected`.** The auto-timeout path (`expireEvalApprovals`) now writes `status='expired'` to `hitl_approval_queue` and `approval_status='expired'` to `workflow_steps`, and no longer stamps `reviewed_at` (an auto-expiry is not a human review). **Old → new:** a consumer that treated a timed-out request as `rejected` must now handle the terminal `expired` status (the OpenAPI approval-status enum is widened accordingly); the regulator-facing `eu_ai_act_hitl_metrics` view now buckets these as `expired_count` instead of over-counting `rejected_count`.

### Added

- **Canonical audit vocabulary + shared normalizer.** A shared `platform/shared/audit` package (with a TypeScript mirror) defines the canonical verdict set, a `Normalize` function that maps every legacy / divergent / case / whitespace spelling to its canonical value (failing safe to `error`), `IsCanonical` / `All` validation helpers, and a read-side `Spellings` expansion so a canonical filter still matches historical rows. (#2638, #2655)
- **Every writer plane emits the canonical vocabulary.** The agent, orchestrator, MCP, gateway, and decision-API writers were converged onto the shared package; `LogWorkflowOperation` now emits `needs_approval`. (#2638, #2659)
- **Audit-coverage completeness across every early-return-deny path.** A denied request can no longer return before writing its audit row:
  - `/decide` early-return denies (decode / stage / empty-input errors, impersonation / tenant-mismatch blocks) now write a canonical `audit_logs` row with `plane=decision`, carrying the attempted-vs-actual tenant. Migration `core/122` backfills history. (#2643)
  - MCP-plane completeness: previously `StaticResult`-gated dynamic-policy, SQL-injection, and redaction decisions, plus the early-return holes, now write a canonical row via the MCP-plane decision writer (carrying `redacted_fields`). (#2641)
  - The gateway pre-check writes a canonical `audit_logs` row on every verdict and on every deny, with redaction distinguishable from a clean allow. (#2642)
  - Control-plane and auth completeness: `AdminAuthMiddleware` records `AUTH_SUCCESS` / `AUTH_FAILURE`, every admin early-deny audits, and SCIM missing-tenant / invalid-JSON requests write to their dedicated audit tables. (#2644)
  - MCP connector-execution routes (`/mcp/resources/query`, `/mcp/tools/execute`) write a canonical row on every terminal verdict — block, redaction (with `redacted_fields`), and error — that previously landed only in a reader-less satellite, so a connector-level block/redaction is now visible in the decisions feed and exports. (#2625)
  - The OpenAI-compatible `/v1/chat/completions` plane records a policy block as a canonical `audit_logs` row (`plane=openai_compat`), previously trace-only. (#2625)
  - Control-plane mutation completeness: detection-posture set/delete, SSO-config create/update/toggle/delete, and API-key issue/revoke write a config/admin audit row on every outcome (secret-free); the orchestrator media fail-closed block writes a canonical `audit_logs` row before the 403; SCIM group-role-mapping missing-tenant / invalid-JSON early-returns audit like every sibling. (#2625)

### Changed

- **`/health` reports the version baked into the binary.** The platform version is now stamped into the binary at build time via `-X` ldflags (new `platform/shared/version` package) rather than read from the `AXONFLOW_VERSION` environment variable at runtime, so `/health.version` and the `io.opencontainer.image.version` image label can no longer drift. (#2664)

### Fixed

- **MCP `list_recent_decisions` advertises the canonical decision filter.** The agent MCP tool's `decision` argument is forwarded verbatim to `GET /api/v1/decisions`, whose `?decision=` filter now rejects non-canonical values with a `400` (above). The tool's advertised enum was still the legacy `allow` / `deny` / `require_approval`, so any client that picked one of those values got a `400`. The enum is now built from the shared canonical set (`allowed` · `blocked` · `redacted` · `needs_approval` · `error`). (#2676)
- **Removed the broken Request Type filter from the `/audit` page.** *(Enterprise)* The portal filter offered six options (`query`, `completion`, `embedding`, `chat`, `search`, `connector`) that never matched the internal `request_type` values actually stored in `audit_logs` (e.g. `decision_llm`, `llm-call`, `mcp-query`), so five of the six always returned zero rows and the sixth missed the primary LLM path. The dead control is removed, along with the now-unused `request_type` field on the `/api/v1/audit/search` request and its orchestrator filter branch. (#2678)
- **Audit retention advances `last_cleanup_at`.** The retention executor now records `audit_retention_config.last_cleanup_at` per `(org, data_type)` after an enforce-prune run, so an operator can see when each table was last pruned. (#2663)
- **RBI board-report generation method + unsent-notification visibility.** *(Enterprise)* The board-report `generation_method` value is corrected to `automatic` (aligned with the migration `CHECK`), and `GenerateReport` now surfaces pending regulatory notifications. (#2640)
- **OJK breach-status lifecycle + 72-hour deadline evaluator.** *(Enterprise)* The breach-notification state machine (`draft → submitted → acknowledged`, with `overdue` / `failed`) now persists and reads `submitted_at` / `acknowledged_at`, evaluates the 72-hour deadline, and exports real values. Migration `enterprise/131` adds the status `CHECK`. (#2639)

### CI / Internal

- **Enterprise-tagged and real-Postgres tests now run in CI.** A new job runs `go test -tags enterprise` plus the `TEST_PG_INTEGRATION` testcontainer suites over `platform/` and `ee/` (orchestrator + agent), wired into the test summary, closing the gap where `//go:build enterprise` code and real-DB tests were shipped but never exercised in standard CI. (#2666)

## [8.7.0] - 2026-06-11 — Governance integrity: audit-trail consolidation, per-org detection posture on every plane, and compliance-export fixes

**Community.** Every change in this release lives in the `platform/` binaries — the agent, the orchestrator, and the shared policy engine — so this release ships to the community mirror; Enterprise-only surfaces (the customer-portal write paths, the SEBI / EU AI Act compliance exports, SCIM) are tagged inline. v8.7.0 consolidates policy decisions onto a single canonical audit record, lets each organization set its own detection enforcement posture independently on every plane, closes a class of compliance-export defects that let regulator-facing exports report success with no data, and corrects audit-feed pagination and PII detection false positives. **No breaking changes.** The new `audit_logs` columns are additive and nullable (migrations 119–121) and require no backfill; every API addition is additive and backward-compatible.

### Audit-trail consolidation

- **`decision_id` and `plane` are now first-class `audit_logs` columns.** Every governed decision writes a canonical row carrying a stable `decision_id` and a `plane` discriminator (`llm`·`mcp`·`agent`·`gateway`·`decision`·`openai_compat`) so a single query returns every block across every enforcement surface. Migration `core/119`. On its own, this makes a cross-plane block queryable in one place.
- **MCP `check-output` blocks emit the canonical `audit_logs` decision row.** A PII block on the MCP response path previously did not produce a decision row in the consolidated shape, so it did not appear in the portal decisions feed. It now writes the same canonical record as every other plane.
- **`correlation_id` groups decisions into chains.** A new nullable `audit_logs.correlation_id` column (migration `core/121`, partial index `WHERE correlation_id IS NOT NULL`) carries the W3C `trace_id` a Policy Enforcement Point propagates across the hops (LLM → tool → agent) of one logical request. Rows sharing a `correlation_id` are the ordered steps of one decision chain; the SEBI and EU AI Act exporters group by it. Legacy rows (no trace) are single-step chains, so grouping never drops a decision.

### Audit-coverage hardening

A pre-release coverage review mapped every enforcement decision to its audit write and closed the highest-impact gaps below.

- **Orchestrator LLM-response decisions now write canonical `audit_logs` rows — and redactions are no longer mislabeled `allowed`.** The response-redaction plane previously recorded a redacted response (including Indonesian NIK/NPWP masking) as `policy_decision="allowed"` with empty `redacted_fields`, and a validation-withheld response wrote no row at all. It now writes a canonical row carrying the true verdict (`redacted` with the masked fields, `blocked` for a withheld response, `allowed` for a clean one), `plane=llm`, `decision_id`, and `correlation_id`.
- **MCP `check-input` emits the canonical `audit_logs` row for every terminal verdict.** Mirroring the `check-output` fix above, a dynamic-policy block and a terminal allow (including allow-with-redaction) on the request plane previously did not appear in the portal decisions feed or `/explain`. They now write the canonical decision row (`plane=mcp`), with no double-write on the static-block or override paths that already record their own row.
- **Self-service password changes are audited.** *(Enterprise)* Forgot-, reset-, and change-password now record audit events (`PASSWORD_RESET_REQUESTED` / `PASSWORD_RESET_COMPLETED` / `PASSWORD_CHANGED`) on success **and** on the security-relevant failure (e.g. a wrong-current-password attempt), closing the asymmetry with the already-audited admin reset path. Rows carry only the event, actor, org, and request metadata — never the password, reset token, or hash.

### Per-org detection posture

- **Agent enforces per-`(org, category)` detection-action overrides.** New `detection_action_overrides` table (migration `core/120`, ENABLE+FORCE RLS by `org_id`) lets each org override the deployment-global action (`PII_ACTION` and the SQLi / dangerous-query / dangerous-command levers) per category, resolved as `effective = per-org override ELSE deployment-global default`. A short-TTL per-org cache keeps the hot path DB-free (`AXONFLOW_DETECTION_OVERRIDE_TTL_SECONDS`, default 60s) and **fails safe to the deployment-global action** on any lookup error. Wired across `check-input`/`check-output`, the gateway pre-check, `/decide`, the proxy, the policy-test surface, and the OpenAI-compatible endpoint.
- **Orchestrator honors per-org posture on the LLM-response redaction plane.** The orchestrator is a separate binary whose response redaction (proxy / gateway / MAP) previously always used the deployment-global action — so a per-org redact under a global warn was reverted and leaked. It now resolves the same per-org override, fail-safe to global.
- **Customer-portal authenticated write path to set posture.** *(Enterprise)* A new `/api/v1/detection-posture[/{category}]` surface (List/Set/Delete) on the session-auth router, gated by `sso:configure`, plus a **Settings → Governance → Detection Posture** UI (`/settings/detection-posture`). The org is taken from the session, never a header/body.

### Compliance-export integrity

- **EU AI Act exports no longer fake success.** *(Enterprise)* Every EU AI Act export processor except decision-chain was a stub returning no rows while the job was marked `Completed` at 100%. Unimplemented export types now **fail honestly** (job → `Failed`) instead of reporting a zero-record success.
- **EU AI Act exports query real, org-scoped data.** *(Enterprise)* The `full_audit`, `conformity_evidence`, `hitl_summary`, `policy_violations`, and `accuracy_metrics` processors now read real data from `audit_logs`, `policy_violations`, the HITL records, and the `euaiact_*` tables.
- **SEBI and EU AI Act exports reconstruct decision chains from `audit_logs`.** *(Enterprise)* Both exports derive their lineage from the canonical decision rows and group by `correlation_id` — SEBI returns `data.decision_chains`; the EU AI Act export returns `decision_chains` + `chain_count`.
- **Audit retention is actually executed.** A retention executor prunes the six config-governed audit tables on schedule — **dry-run by default**, deleting only when retention enforcement is explicitly enabled, with an admin-portal surface to inspect a run.
- **`admin_audit_log` + `scim_audit_log` writers are wired.** *(Enterprise)* Administrative and SCIM operations are now recorded to their dedicated tables (the SCIM writer RLS-scoped to the acting org via `withOrgScope`).

### Decisions / audit feed

- **`total` is the true count of matching rows**, not the size of the returned page, so a UI can render an accurate "1–N of M".
- **`offset` is applied** to the search query — pagination no longer repeats the first page.
- **`tenant_id` and `user_email` filters do case-insensitive partial (ILIKE) matching**, so an operator can search by a fragment.
- **`action` filter on `policy_decision`** (`allowed`/`blocked`/`redacted`/`error`) added to audit search.
- **The portal audit view no longer steals input focus** on each filter fetch — typing in a filter while results refresh no longer drops keystrokes. *(Enterprise)*
- **SCIM group-to-role mapping endpoints are mounted.** *(Enterprise)* The previously-unreachable group→role mapping routes are mounted on the session-auth router behind `sso:configure` (a privilege grant, so deliberately not the bearer `/scim/v2` provisioning router); org resolved from the session; every change written to the SCIM audit log.

### PII detection false positives

- **Context-gated broad detectors.** Bare-12-digit Aadhaar and Singapore NRIC/FIN now require an adjacent label/indicator before they fire, so a benign order ID or barcode is not masked.
- **JSON-structure-aware masking.** A redacted response always stays valid JSON: a numeric-position value (e.g. a NIK stored as an integer) is masked **and** coerced to a string; escaped PII (`\uXXXX`) is decoded and matched; an unsafe result **fails closed** rather than emitting broken JSON.
- **Closed IP-on-version-string and phone-on-tracking-ID false positives.**

### Capabilities

- **`/health` recommends claude-code plugin v1.6.0** (the version carrying the Enterprise self-hosted MCP login fix). The recommended claude-code plugin version is bumped 1.5.3 → 1.6.0; SDK and other plugin recommendations unchanged.

## [8.6.0] - 2026-06-09 — Decision Mode PII governance: validator-assignment fixes, request + response NIK/NPWP redaction on every plane, and engine-fulfillable obligations

**Community.** Every change in this release lives in the `platform/` and `platform/shared/` binaries — the agent, the orchestrator, and the shared policy engine — so this release ships to the community mirror. The fixes and additions are reachable in both editions; where behavior differs by edition it is called out inline. In particular, the **Enterprise** build supplies checksum/province-validated Indonesian NIK/NPWP detection (the precision behind the redaction below), while **Community** uses pattern-based Indonesian PII detection — and as of this release both editions govern that PII on the **request and the response** path. No breaking changes; every API and policy-engine change is additive and backward-compatible.

### Fixed (Community)

- **PII validators were misassigned for every database-loaded policy — email, phone, and IP detection were silently inert for all tenants.** The policy loader selected a value validator with an exact `ValidatorRegistry[policyID]` lookup that never matched the `sys_pii_*` policy IDs, so every PII policy fell through to its category default — the **credit-card** validator for `pii-global`, which rejects every non-card string. The net effect: `email` / `phone` / `ip` detection never fired on the request **or** response path, on any deployment, and `pan` was validated against the **Aadhaar** validator. The loader and the evaluator now share a deterministic `ValidatorForPolicyID` (ordered segment-token match, replacing a non-deterministic map-iteration matcher in the evaluator). After the fix: `email` / `phone` / `ip` resolve to their correct validators (were inert); `pan` → `ValidatePAN` (was Aadhaar); `sys_pii_indonesia_phone` / `sys_pii_singapore_phone` → `ValidatePhone` (were accept-all). This has the broadest blast radius of anything in the release — it restored basic PII detection for every tenant. (#2565)
- **Indonesian NIK/NPWP leaked on the agent response path.** The agent's response engine (`POST /api/v1/mcp/check-output`, used by the PEP/gateway response flow and the MCP `tools/call` path) derived its PII category whitelist from a hardcoded literal that omitted `pii-indonesia`, and ran no checksum-validated NIK/NPWP detector on responses. Response evaluation now derives the category whitelist from the enabled policies (`UnifiedPolicyEngine.EnabledPIICategories` plus a convention classifier for any `pii-`-prefixed category), and runs the Indonesian detector on the response — blocking critical NIK/NPWP under `PII_ACTION=block` and masking under `PII_ACTION=redact`, while `warn`/`log` detect without mutating. Redaction is surfaced uniformly via `OutputPolicyOutcome.WasRedacted()` so an Indonesia-only redaction can neither leak the unmasked original nor be recorded as un-redacted in the audit trail. (#2565)
- **Indonesian NIK/NPWP leaked on the orchestrator / LLM-gateway response path.** The orchestrator's `ResponseProcessor.ProcessResponse` (proxy / gateway / MAP LLM responses) carried no checksum-validated NIK/NPWP detector. The same Indonesian detector is now wired into the response path via a side-effect-free deep walk (`maskIndonesiaPIIDeep`) that masks string leaves in any decoded-JSON shape and folds detected type names into the audit `RedactionInfo`, with the same `PII_ACTION` semantics (detect-don't-modify on `warn`/`log`, mask/deny on `redact`/`block`). (#2568)
- **Indonesian NIK/NPWP was not redacted on the request path under `PII_ACTION=redact`.** The request-phase entry points only hard-denied NIK under `PII_ACTION=block`; under `redact` they let it through. The validator-backed redact flag is now wired on all three request entry points — Gateway pre-check, `POST /api/v1/decide`, and `POST /api/v1/mcp/check-input` — so a checksum-valid NIK is redacted under `redact` (mirroring the existing RBI handling). Block mode still hard-denies. (#2573)
- **`sys_pii_passport` (block) and `sys_pii_dob` policies were validator-inert.** Same misassignment class as the email/phone fix above: with no matching token they were stamped the credit-card default and never matched on any path. Added `ValidatePassport` and `ValidateDOB`, both **proximity-gated** — the passport/birth-date indicator must immediately precede the value — because the underlying patterns are broad and the shared engine's `EvaluateAll` has no confidence threshold (a valid match always fires). This prevents a generic order number from being blocked as a passport, or an invoice/due date from being redacted as a date of birth. (#2570)
- **Context-gated the broad Singapore PII detectors (postal code, UEN).** They now redact only when a nearby label confirms the value; previously they fired on any matching number and — under engine-backed response redaction — could hard-block a benign tool response. No loss of real PII coverage; labelled values still redact. (#2575)

### Added (Community)

- **Decision Mode obligations are now self-describing and engine-fulfillable.** `POST /api/v1/decide` stays a pure Policy Decision Point and never mutates content. Each `redact_pii` obligation it returns now carries a `fulfillment` block — `endpoint`, `method`, `phase`, and the `content_types` the endpoint can redact — that tells a Policy Enforcement Point exactly which engine call discharges the obligation. Client-side redaction is impossible by construction: a conforming PEP POSTs the content to the named endpoint and forwards the engine-redacted result, rather than hand-rolling its own patterns. (ADR-056 / ADR-057.) (#2564)
- **`POST /api/v1/mcp/check-input` returns engine-redacted request content.** `check-input` now returns `redacted` / `redacted_statement` (the engine-masked request statement) plus `redaction_evaluated` (whether the detector actually ran). This is the request-phase home that makes a `/decide` `redact_pii` obligation fulfillable, and is symmetric with `check-output`'s response-phase `redacted_data`. Request redaction is policy-derived and connector-agnostic, and a PEP fails closed when `redaction_evaluated` is false (the detector did not run) so an un-evaluated request can never be forwarded as if it were clean. (#2564)
- **`platform/shared/pep` — the blessed PEP client.** A shared client that runs the decide → fulfill-via-named-endpoint → forward flow with HTTP Basic auth. It holds no redaction logic of its own and fails closed if an obligation is not engine-fulfillable or the redactor did not run. The reference LLM and MCP adapters were corrected to fulfill (not silently drop) the `redact_pii` obligation. (#2564)
- **`/health` capability discovery advertises the new Decision Mode surface.** The agent capability list (surfaced at `GET /health`) now includes `decision_obligations` and `two_touch_redaction` (`since: 8.6.0`), so SDKs, plugins, and PEPs can feature-detect the obligation contract and request + response redaction without version sniffing.

### Tests (Community)

- Per-plane deterministic CI tests for the request-phase Indonesian redaction (red on revert), validator-selection regressions (locale-phone narrowing, credit-card-default lock, passport/DOB proximity-gating both directions), and the response-path leak locks (`WasRedacted` gate, non-vacuous empty-set guard). Runtime end-to-end proofs against a live agent + orchestrator over real HTTP: `2563_response_pii_categories`, `2566_orchestrator_indonesia_response`, `2567_passport_dob_validators`, `2563_obligation_pep`, `2571_indonesia_nik_redaction`, and a `2563_v860_release_smoke` that boots the version-bumped tree and asserts `/health` reports `8.6.0` + the new capabilities, `/decide` emits a self-describing `fulfillment` obligation, and `check-input` returns `redacted_statement`.

---

## [8.5.2] - 2026-06-08 — Portal works over HTTP self-host + MCP plugin auth connects on self-hosted/Enterprise + audit stats count denials correctly

**Community + Enterprise.** The portal fixes are enterprise-only (`ee/platform/customer-portal[-ui]` plus an additive helper migration). The MCP-auth and audit-summary fixes below are in the **community** `platform/agent` and `platform/orchestrator` binaries, so — unlike the original `8.5.2` plan — this release **does** ship to the community mirror (community sync is **not** skipped).

### Fixed (Community)

- **Agent returns parseable JSON, not plaintext, on OAuth-discovery probes.** The MCP server authenticates with HTTP Basic (`base64(org_id:license_key)`) and sends `WWW-Authenticate: Basic` on its `401`, but some MCP clients (e.g. Claude Code) respond to the `401` by probing an open-ended set of OAuth-discovery URLs (`/.well-known/oauth-protected-resource[/<resource-path>]`, `/.well-known/oauth-authorization-server`, `/.well-known/openid-configuration`, `/register`, …) and parse each non-2xx body as an OAuth error JSON. gorilla/mux's default `404`/`405` emit Go's plaintext `404 page not found` / `Method Not Allowed`, so the client crashed with `HTTP 404: Invalid OAuth error response … Raw body: 404 page not found` and marked the server failed — even though the real problem was just a missing credential. The agent router now returns RFC 6749 §5.2-shaped JSON for every unmatched route / wrong method (global `NotFoundHandler` + `MethodNotAllowedHandler`), and serves `/.well-known/oauth-protected-resource` / `/.well-known/oauth-authorization-server` (covering the resource-path-suffixed forms) with a specific advisory naming `AXONFLOW_AUTH` / `AXONFLOW_ENDPOINT` and advertising **no** authorization server — so the client renders a clear message instead of crashing, and never starts an OAuth flow this server can't complete.
- **Audit summary counts policy denials as blocked.** `get_policy_stats` and the portal compliance card under-reported blocks: a denied tool call (e.g. an SSN caught by `sys_pii_ssn` via a plugin's `PreToolUse` hook calling `check_policy`) is recorded in `audit_logs` with `policy_decision="deny"`, but the summary aggregation only bucketed `"blocked"` — so `"deny"` fell through to the "allowed" branch and a real block showed as `0 blocked / 100% compliance / all-info severity`. The write-path vocabulary is split (agent `check_policy` → `"deny"`; gateway-mode → `"blocked"`); the summary now counts `blocked`/`deny`/`denied` as blocked in both the action-triage and the top-policies block-count queries. This is server-side, so it corrects the stats for **every** plugin (Claude Code, Cursor, Codex, openclaw) — they all route blocks through the agent's `check_policy` path.

### Changed (Community)

- **Recommended host-CLI plugin version bumped to 1.5.3** for Claude Code and Cursor. The agent and orchestrator capability response (surfaced at `/health`) now advertises `1.5.3` as the recommended version for those two; plugins below it receive an actionable upgrade-warning header on every governed call. 1.5.3 carries the plugin-side fix that sends HTTP Basic auth correctly against self-hosted / Enterprise endpoints (the `${CLAUDE_PLUGIN_ROOT}` headers-helper expansion), which pairs with the agent OAuth-discovery fix above. Codex stays at `1.5.2` (its v8.5.2 fix was documentation-only). The minimum-supported floor is unchanged (`1.4.0`; openclaw `2.4.0`), and openclaw's recommended version stays `2.6.1`.

### Tests (Community)

- Agent: `mcp_oauth_discovery_test.go` pins the JSON 404/405 responses and the well-known advisory (no `authorization_servers`, names `AXONFLOW_AUTH`). Orchestrator: `TestAuditSummaryHandler_HandleSummary_CountsDenyAsBlocked` asserts `deny`/`denied` count as blocked. Both verified end-to-end through the real `claude` binary against a self-hosted in-vpc-enterprise bundle with a real license.

---

**Enterprise (customer-portal) — original `8.5.2` scope, unchanged below.** Every portal change is under `ee/platform/customer-portal[-ui]` plus an additive helper migration and version/compose bumps.

Patch release closing out self-hosted portal access. Two complementary halves of the same symptom: the deployment org now gets a login credential provisioned at boot, and the session cookie is no longer dropped when the portal is served over plain HTTP (the install bundle / evaluation deployments). Together a fresh HTTP install is loginable and the login sticks — previously a fresh install had no portal password, and even once one was set every authenticated request returned `401`. Also stops the dashboard from masking a fetch failure with a fabricated license. HTTPS/production deployments are unaffected and stay secure by default. No breaking changes; additive migration only.

### Added (Enterprise)

- **Portal login credential auto-provisioned at boot.** In `enterprise` / `in-vpc-*` deployments the deployment organization (`ORG_ID`) is the portal login identity, but the agent's license-tier promotion created that organization row without a `password_hash` — so a fresh install had a portal no one could log into until someone ran manual SQL. The portal now bootstraps the deployment org's password from `AXONFLOW_PORTAL_ADMIN_PASSWORD` at startup: fail-closed (it refuses to boot in those modes if the password is unset, rather than coming up un-loginable), no-clobber (an operator-set password is never overwritten on restart), and create-if-missing. A `reset-portal-credential.sh` operator script is included for recovery. (#2552)

### Fixed (Enterprise)

- **Session cookie `Secure` attribute is now conditional.** The `axonflow_session` cookie was set with a hardcoded `Secure` attribute at all three session-cookie sites (login, logout, SAML callback). When the portal is served over plain HTTP, the browser silently drops a `Secure` cookie, so every authenticated request reached the auth middleware with no cookie and returned `401 Unauthorized` ("no session") before any database query — and the dashboard then rendered a placeholder license. The attribute is now gated on `AXONFLOW_PORTAL_COOKIE_SECURE`, which defaults to `true` so HTTPS/production keeps the `Secure` attribute with no configuration change; operators set it to `false` for an HTTP self-host or evaluation deployment on a trusted internal network. The logout (cookie-clearing) attributes match the set cookie so logout reliably clears the cookie. The bundled `docker-compose.enterprise.yml` defaults the override to `false` for the local/eval HTTP flow.

- **The dashboard no longer fabricates a license on a fetch failure.** When the license-status call failed (e.g. the `401` above), the dashboard previously substituted a hardcoded `Community / DEVELOPER` placeholder, which read as a real downgraded license and masked the true Enterprise entitlement. It now captures the error, leaves the license unset, and renders an explicit "License status unavailable" state. This is display-only and does not change any entitlement.

- **Portal session lookup is now RLS-safe under the application role.** The portal auth middleware reads `user_sessions` by session id before any organization context is established (the lookup is what discovers the session's org), so it could not use the request-scoped tenant GUC. Under the NOBYPASSRLS application role with `FORCE ROW LEVEL SECURITY`, that direct read returned zero rows and would have rejected every portal session. The lookup now goes through a new `SECURITY DEFINER` helper (additive migration) that resolves the session without exposing the underlying table, falling back to the direct read on databases that predate the migration. No effect on current deployments (which connect as a role that bypasses RLS); this hardens the path for the application-role posture.

### Tests

- Added a runtime end-to-end test (`runtime-e2e/portal_cookie_secure_http`) that drives the real agent + portal binaries over HTTP: it asserts the cookie keeps `Secure` by default, drops it under `AXONFLOW_PORTAL_COOKIE_SECURE=false`, and that an HTTP login then returns `200` with the correct licensed tier from `GET /api/v1/license/status`. Plus a unit test pinning the `AXONFLOW_PORTAL_COOKIE_SECURE` parsing (default-true, case-insensitive `false`).

## [8.5.1] - 2026-06-08 — Licensed tier reported correctly in the portal/database + dev-mode token endpoint

Patch release. Fixes a tier-reporting divergence where the licensed tier was held only in agent memory and never written to the `organizations` table, so the portal and other database consumers could lag behind `/health`. Also adds a non-production developer convenience for minting user tokens. Additive migration only; no breaking changes.

### Added (Community)

- **Dev-mode token endpoint (`POST /api/v1/dev/token`).** In an explicitly non-production deployment, mints a short-lived HS256 `user_token` from the authenticated Basic-auth credential, so local and CI integrations don't have to hand-run a JWT signing script. Fail-closed: the endpoint is **only registered** when an explicitly non-production `ENVIRONMENT` / `DEPLOYMENT_MODE` / `DEPLOYMENT_KIND` is set — otherwise the route returns `404`; and when registered but `JWT_SECRET` is not configured it returns `503` rather than minting. The token's tenant is inherited from the Basic-auth username, and the signing algorithm is pinned to HS256. Never reachable in production.

### Fixed (Community)

- **The agent now writes the licensed tier into the database at boot.** After validating the deployment license, the agent upserts the deployment organization's `tier` and `max_nodes` to the licensed values, using a new RLS-safe `SECURITY DEFINER` migration so the write clears `FORCE ROW LEVEL SECURITY` without giving the request path elevated privileges. Previously the licensed tier lived only in agent memory (surfaced at `/health`) while `organizations.tier` stayed at the seeded `Community` default — so the portal UI, node-limit enforcement, and compliance-evidence paths could report `Community` on a valid Enterprise license. The promotion runs at boot and is idempotent: it writes only when the tier or node limit actually differs.
- **Tests:** added a runtime end-to-end test that boots a freshly-installed Enterprise deployment and asserts the database reports `Enterprise` with no prior request traffic, plus a migration-level unit test for the promotion helper.

### Documentation

- Expanded architecture documentation: a "Five Runtime Modes" overview with Decision / MAP / WCP sequence diagrams describing how governance is enforced in each runtime mode.

## [8.5.0] - 2026-05-30 — Decision Mode context propagation + Pasal 56(b) attestation + multi-arch images

Minor release. Decision Mode gains request-context propagation and durable audit persistence, OJK compliance gains an explicit UU PDP Pasal 56(b) transfer-basis tag plus a wired cross-border-transfers export, and all six platform images now ship for both `linux/amd64` and `linux/arm64`. Indonesia compliance migrations (OJK + UU PDP + BI) relocated from `industry/banking/` to `enterprise/` so they load in every in-vpc-enterprise deployment by default. No breaking changes. SDKs are also updated in this release train — Go / Python / TypeScript / Java to **v8.4.0** and Rust to **v0.6.0** — adding the typed `context` field on `DecisionSummary` / `DecisionExplanation` and the `pasal_56b_dpa` transfer-basis value; see each SDK's own release notes for details.

### Added (Community)

- **Decision Mode request-context propagation (`request.context`).** `POST /api/v1/decide` accepts an optional top-level `context` object — arbitrary caller-supplied key/value metadata (e.g. `tenant_tier`, `region`, `feature_flag`) that rides alongside the decision for audit and correlation. Keys are filtered against an allowlist, canonicalized, capped at 256 bytes per value and 10 keys per request, and a `request.context.truncated` flag is set when either cap trims the payload. Allowed keys land as OTel span attributes under `request.context.<key>` for trace-side filtering. The allowlist is configurable via `AXONFLOW_DECISION_CONTEXT_ALLOWLIST` (comma-separated); the default ships a curated set of agent/session/leader identity headers plus a tenant-scoped header family. Closes #2509.

- **Decision Mode decisions now persist to `audit_logs`.** Previously `POST /api/v1/decide` emitted only an OTel span, so `GET /api/v1/decisions` returned empty for Decision Mode callers who had not wired an OTel backend. Each decision now also writes a best-effort row to `audit_logs` (mirroring `writeExplainableAuditLog`), with the propagated context stored under `policy_details->'context'`. `GET /api/v1/decisions` surfaces a 5-key truncated view of the context; the explain endpoint returns the full context plus a `context_truncated` flag. OpenAI-compatible callers continue to use `llm_call_audits` unchanged. (BUKU-A scope expansion on #2509.)

- **`examples/mcp-decision-mode/` reference adapter.** A runnable Python MCP server demonstrating the PEP/PDP pattern: the MCP server (PEP) calls AxonFlow `POST /api/v1/decide` (PDP) before exposing tool results, with Indonesia PII detection and a fail-closed default. Includes a stdio end-to-end harness and unit tests. Closes #2510.

### Added (Enterprise)

- **UU PDP Pasal 56(b) transfer-basis tag (`transfer_basis = "pasal_56b_dpa"`).** Cross-border transfer records can now carry an explicit Pasal 56(b) Data Protection Agreement basis alongside the existing `safeguards` field. The tag is backward-compatible and never auto-translated from other bases. New `TransferBasisCanonicalForms()` and `TransferBasisValid()` helpers validate the accepted set. Closes #2511.

- **OJK cross-border transfers audit export wired.** `OJKDataTypeCrossBorder` was a declared export data type whose switch arm fell through, returning empty. This release ships the missing `queryCrossBorderTransfers` query (org-scoped and parameterized), so `POST /api/v1/ojk/audit/export` with `data_type=cross_border_transfers` returns the logged cross-border transfer records. (BUKU-C scope expansion on #2511.)

### Fixed

- **Grafana Prometheus datasource 404 in the bundled stack.** The bundled `axonflow-grafana` image generated a Prometheus datasource URL with no path, but `axonflow-prometheus` runs with `--web.external-url=/prometheus`. Datasource provisioning now references `http://prometheus:9090/prometheus`, so Grafana panels query Prometheus successfully out of the box. Closes #2507.

### Changed (Self-hosted)

- **Multi-architecture platform images.** All six platform images (agent, orchestrator, customer-portal, customer-portal-ui, and the bundled prometheus/grafana) now build and publish for both `linux/amd64` and `linux/arm64`. Apple Silicon Macs, AWS Graviton, and Ampere ARM Linux hosts run AxonFlow natively — no Rosetta/QEMU emulation and no `platform: linux/amd64` pin required in `docker-compose`. Closes #2506.

- **Indonesia compliance migrations relocated** from `migrations/industry/banking/` to `migrations/enterprise/` (versions 127–130). `in-vpc-enterprise` deployments now load the OJK + UU PDP + BI compliance tables and the cross-border `transfer_basis` / `data_residency` audit columns by default, so `POST /api/v1/ojk/audit/export` works in `in-vpc-enterprise` mode (previously returned HTTP 500 because these migrations only loaded under `saas` / `in-vpc-banking`). No customer action required for existing `saas` / `in-vpc-banking` deployments — the migrations are idempotent and re-apply cleanly under their new version numbers. Closes #2516.

### Notes for self-hosted operators

- **OTel collector attribute namespace.** Decision Mode now emits span attributes under the `request.context.*` namespace (one attribute per allowlisted context key). If you filter or index decision spans by attribute, add `request.context.*` to your collector's keep/allow rules so the new attributes are retained.
- **`audit_logs` now receives Decision Mode rows.** Any consumer that tails `audit_logs` (SIEM forwarders, retention sweepers, dashboards) will begin seeing rows originating from `POST /api/v1/decide` in addition to the existing Proxy/Gateway sources. The new rows carry the decision context under `policy_details->'context'`. No schema migration is required — the column already existed.
- **Platform-pin removal.** If you added `platform: linux/amd64` to your `docker-compose` services as a v8.4.0 workaround on ARM hosts, you can remove it in v8.5.0 — the images now resolve a native `linux/arm64` manifest.
- **Indonesia compliance migration relocation** (above) — if you query `schema_migrations` directly, expect to see versions 127–130 register on next boot for `saas` and `in-vpc-banking` deployments (they re-apply the previously-applied SQL under the new version numbers; the SQL is idempotent so the operations are no-ops).

## [8.4.0] - 2026-05-28 — Self-hosted deployment alignment + OpenAI-compatible gateway endpoint

### Added (Self-hosted)

- **`docker-compose.enterprise.yml` aligned with production CFN templates.** Closes the hand-authoring drift class (#2498). Self-hosted operators upgrading from prior versions must set `AXONFLOW_INTERNAL_SERVICE_SECRET` (32+ chars, e.g. `openssl rand -hex 32`) on the agent, orchestrator, and customer-portal env blocks — without it, the customer-portal can't authenticate calls to the agent and the unified-policies UI silently shows 0 system policies. AWS CFN-deployed stacks are unaffected (the secret was always injected from `InternalServiceSecret`). Also added: `audit-data` named volume for audit-fallback persistence across restarts, resource limits mirroring CFN sizing, and `curl -f` healthchecks matching the CFN-defined commands.

- **`DEPLOYMENT_KIND` overlay default kept at `dev`.** Self-hosted operators flipping `DEPLOYMENT_KIND=production` must also set a real `ORG_ID` (not the `local-dev-org` sentinel) at the same time — migration 094's prod-safety guardrail aborts boot on the (`production` + `local-dev-org`) combo to prevent silent dev-sentinel stamping of audit rows.

- **`axonflow-install` bundled stack** with OpenTelemetry collector + Tempo + a Decision Mode Traces Grafana dashboard (at `http://localhost:3001/d/decision-mode-traces`) out of the box for self-hosted deployments on non-AWS (e.g. GCP). One-command deploy via `./install.sh`. Closes #2496.

Milestone 1 of the OpenAI-compatible gateway. Existing OpenAI SDK users can route calls through AxonFlow for policy enforcement and audit by changing a single line (`baseURL`). No new SDK to learn, no request format changes — the endpoint accepts and returns standard OpenAI Chat Completions wire format. Verified end-to-end with the Python and TypeScript OpenAI SDKs against real OpenAI API.

### Added (Community)

- **OpenAI-compatible gateway endpoint (`POST /v1/chat/completions`).** Drop-in governance for OpenAI SDK users. The agent accepts a standard [OpenAI Chat Completions](https://platform.openai.com/docs/api-reference/chat/create) request, evaluates AxonFlow policies (PII detection, SQL injection blocking, dangerous query prevention, compliance rules), and either blocks the request with an OpenAI-compatible error or forwards it to the upstream provider and returns the response unchanged. Verified with Python `openai` v2.38.0 and TypeScript `openai` latest.

  **Quick start (Python):**
  ```python
  from openai import OpenAI
  client = OpenAI(
      base_url="http://localhost:8080/v1",
      default_headers={"X-Provider-Key": OPENAI_API_KEY}
  )
  response = client.chat.completions.create(model="gpt-4o-mini", messages=[...])
  ```

  **Key behaviors:**
  - Policy denials return HTTP 400 with `{"error": {"type": "policy_violation", "code": "policy_denied"}}` — the OpenAI SDK parses this as `BadRequestError`, so existing error handling works unchanged.
  - Every request is audited: model, provider, prompt/completion token counts, estimated cost, latency, and policy decision (`allow` or `deny`).
  - Response headers `X-AxonFlow-Decision-Id` (UUID) and `X-AxonFlow-Trace-Id` (W3C 32-hex) enable audit correlation and OTel tracing.
  - Provider API key supplied via `X-Provider-Key` header (not stored by AxonFlow).
  - `stream: true` returns a clear HTTP 400 error — streaming support is planned for a future release.
  - Same authentication as all AxonFlow endpoints (community mode: no auth; enterprise: Basic Auth).

  **Documentation:** [OpenAI-Compatible Gateway](https://docs.getaxonflow.com/docs/sdk/openai-compatible-gateway/)

## [8.3.0] - 2026-05-27 — Indonesia compliance + OTel exporters

Minor release. Adds Indonesia regulatory compliance coverage: PII detection patterns for Indonesian identifiers, OJK (Otoritas Jasa Keuangan) AI governance module for financial services, and UU PDP (Law No. 27/2022) breach notification support. SDKs updated to v8.3.0 (Rust v0.5.0) with Indonesia category support and audit fields.

### Added (Community)

- **Indonesia PII detection (`pii-indonesia` category).** Eight context-anchored patterns: NIK (national ID, province-code validated), NPWP legacy 15-digit, NPWP new 16-digit, +62 phone numbers, and four major bank account formats (BCA, Mandiri, BRI, BNI). All bank and NPWP patterns are context-anchored to minimize false positives against credit card numbers, UUIDs, and timestamps.

- **OTel observability exporter configurations.** Pre-built OTel Collector configs for Datadog (`docker-compose.otel-datadog.yml`) and Grafana + Tempo + Prometheus (`docker-compose.otel-grafana.yml`). The spanmetrics connector generates `calls_total` and `duration_milliseconds` Prometheus metrics from decision spans. A 9-panel Grafana dashboard (`grafana/dashboards/decision-mode-overview.json`) provides verdict distribution, latency percentiles, policy trigger rates, and per-tenant breakdown out of the box.

### Added (Enterprise)

- **OJK compliance module.** Six API endpoints under `/api/v1/ojk/`: audit export (list + by-ID), audit retention configuration, audit readiness check, breach notification, and compliance dashboard. Supports `AXONFLOW_COMPLIANCE_REGION=ID` with enforced 1825-day (5-year) minimum retention floor per OJK AI governance requirements.

- **UU PDP breach notification.** Article 46 compliant breach notification with required fields, 72-hour SLA calculation, and MOCDA (Ministry of Communication and Digital Affairs) as default authority. Integrates with the OJK audit export pipeline.

- **Cross-border transfer audit fields.** New columns on audit tables for logging cross-border data transfer metadata required by Indonesian financial regulators.

- **Four industry migrations.** OJK compliance tables, OJK policy templates, audit cross-border fields, and breach notification tables (migrations 500–503 under `industry/banking/`).

### Changed

- **SDK version recommendations.** Platform `/health` now advertises SDK v8.3.0 (Go, Python, TypeScript, Java) and Rust SDK v0.5.0 as recommended versions. Minimum SDK floor remains v8.0.0.

## [8.2.1] - 2026-05-25 — Customer Portal bug sweep + SEBI compliance fix

Bug-fix patch. Resolves all customer portal console errors on both self-hosted and managed deployments. The customer portal now renders all 16 pages with zero console errors in enterprise mode. Includes a critical SEBI compliance export fix where 6 of 11 projected columns didn't match the actual database schema.

### Fixed (Enterprise)

- **SEBI audit export decision chain query.** The `exportDecisionChain` SQL query projected 6 columns that don't exist in the `decision_chain` table: `decision` (real: `decision_outcome`), `confidence` (real: `risk_level`), `rationale` (removed), `human_override` (real: `requires_human_review`), `override_by` (removed), `override_reason` (removed). Added missing columns: `policies_evaluated`, `policy_triggered`, `processing_time_ms`. Every SEBI compliance export that included decision chain data would fail with a Postgres column-not-found error.

- **Customer portal docker-compose routing.** The portal-ui proxy was pointing at the agent instead of the customer-portal backend. All session-authenticated requests returned 401. The proxy now routes to the customer-portal, which handles session auth natively and proxies governance calls internally.

- **LLM Provider create form.** The portal UI sent `name` but the backend expects `provider_name`. Every Add Provider form submission failed with "provider_name is required".

- **Policy Override dialog unusable.** The Override System Policy modal had a z-index bug where the backdrop overlay intercepted all clicks. Fixed with proper z-index layering and added Escape key handler. Same fix applied to all other modal dialogs (Add Provider, Add Connector, Create API Key).

- **Raw JSON errors shown to users.** API error responses were displayed verbatim. Added error formatting that maps HTTP status codes to user-friendly messages.

- **SCIM endpoint URLs showing localhost.** The SCIM configuration page showed incorrect URLs in docker-compose. Fixed by wiring the base URL as a build-time configuration.

- **SCIM tokens page crash.** The SCIM page crashed when the tokens endpoint returned `null` instead of an empty array. Added null-safety guards.

- **Dashboard empty fields.** Welcome message, Organization ID, and license tier showed empty or raw values. Added fallbacks for all empty-state fields.

- **Subtitle text empty on 3 pages.** LLM Providers, Connectors, and Export pages showed empty subtitle text. Added "your organization" fallback.

### Changed (Community SaaS — Plugin Tiers)

- **Per-minute burst rate limits.** Tier-aware enforcement: Free tier 25 requests/minute, Pro tier 200 requests/minute. Applied consistently across API auth, proxy, and MCP session paths.

- **Plugin tier limit adjustments.** Free tier active custom policies increased from 2 to 4. Free tier HITL approvals per week increased from 1 to 2. Pro tier caps added: 50 active policies, 20 HITL approvals per week.

## [8.2.0] - 2026-05-24 — Decision Mode (PDP/PEP policy decision service) + OTel decision tracer

Additive minor release. Decision Mode brings the Policy Decision Point / Policy Enforcement Point pattern (established by OPA, XACML, Cedar) to AI governance: infrastructure gateways query AxonFlow for a policy verdict before forwarding traffic. The OpenTelemetry decision tracer wires every policy decision into a standard observability pipeline. Three new ecosystem integration packages land on PyPI and npm. No breaking changes, no schema changes, no migration impact.

### Added (Community)

- **Decision Mode — PDP/PEP policy decision service (`POST /api/v1/decide`).** Brings the Policy Decision Point / Policy Enforcement Point pattern to AxonFlow. Infrastructure gateways (the PEP) query AxonFlow (the PDP) for a synchronous policy verdict before forwarding requests upstream. Request: `{stage, caller_identity, target, query}` where `stage` is `llm`/`tool`/`agent`. Response: `{verdict, decision_id, trace_id, reasons, obligations, evaluated_policies}`. Same shared-policy engine as Gateway Mode's `POST /api/policy/pre-check`. Available at all tiers.

- **OTel decision tracer + exporter pipeline.** One decision = one OTel span (`axonflow.decision`) with eight attributes covering decision metadata and identity. W3C `trace_id` returned in pre-check and decide responses for gateway-layer trace correlation. Configurable via `AXONFLOW_OTEL_ENDPOINT` (empty = noop, no required infra), `AXONFLOW_OTEL_SERVICE_NAME`, `AXONFLOW_OTEL_SAMPLE_RATE`. `docker-compose.otel.yml` overlay provides a local Jaeger setup.

- **Decision Mode reference PEP adapters.** Two reference adapters: LLM + Agent gateway (`examples/integrations/decision-mode-adapter/`, Go HTTP middleware) and MCP gateway (`examples/integrations/decision-mode-mcp-adapter/`, JSON-RPC 2.0 interceptor). Both include docker-compose PoC harnesses with test scripts.

### Added (Ecosystem — standalone repos, announced here)

- **axonflow-litellm** ([PyPI](https://pypi.org/project/axonflow-litellm/)). LiteLLM SDK callback integration via `CustomLogger` subclass. `pip install axonflow-litellm`. Standalone repo: [getaxonflow/axonflow-litellm](https://github.com/getaxonflow/axonflow-litellm).

- **axonflow-google-adk-plugin** ([PyPI](https://pypi.org/project/axonflow-google-adk-plugin/)). Google Agent Development Kit plugin for policy checks and HITL approval within ADK agent flows. Standalone repo: [getaxonflow/axonflow-google-adk-plugin](https://github.com/getaxonflow/axonflow-google-adk-plugin).

- **@axonflow/n8n-nodes-axonflow** ([npm](https://www.npmjs.com/package/@axonflow/n8n-nodes-axonflow)). n8n community node with four operations: Check Policy, Record Decision, Audit Log, Wait for Approval. Standalone repo: [getaxonflow/axonflow-n8n-node](https://github.com/getaxonflow/axonflow-n8n-node).

### Changed

- **Decision Mode architecture.** New integration mode using the PDP/PEP pattern alongside Gateway Mode, Proxy Mode, and WCP. Integration packages follow MIT license and `axonflow-` naming conventions.

- **Integration package stubs.** `examples/integrations/google-adk-plugin/` and `examples/integrations/n8n-axonflow-node/` replaced with stub READMEs pointing to their standalone repos.

### Fixed

- **HITL `require_approval` policies now correctly return the `require_approval` sentinel in Gateway Mode pre-check.** When a custom policy with `action=require_approval` matched, the pre-check response returned the policy description as `block_reason` instead of the `require_approval` sentinel string that SDKs and plugins check to trigger the HITL approval flow. The approval flow silently did not activate. Now `require_approval` policies return `block_reason="require_approval"` so SDK-side HITL detection works correctly.

## [8.1.0] - 2026-05-23 — HITL outbound webhook callback + HTTP Idempotency-Key dedup

Minor release on top of v8.0.1. Two additive features that close gaps surfaced during the Google ADK plugin + n8n community node R3 — workflow tools that pause on a webhook can now resume without a polling sidecar, and `Retry on Fail` retries no longer double-create approval rows or double-record audit entries.

No breaking changes. No schema reshuffle. Existing v8.0.0 SDKs and plugins (claude/cursor/codex at v1.4.0, openclaw at v2.4.0) continue to work unchanged — both features are opt-in via headers / request fields. Self-hosted deployments running v8.0.0 can apply the two new migrations and ship.

### Added

- **HITL outbound webhook callback (`notify_url`).** `POST /api/v1/hitl/queue` accepts an optional `notify_url` field (https or http). When set, the platform fires a signed HTTP POST to that URL after the row reaches a terminal state — `approved`, `rejected`, `overridden`, or `expired`. The envelope carries `approval_id`, `status`, `decided_by`, `decided_at`, `original_query`, `request_type`, `severity`, and a `decision_envelope` bag with the comment / justification / triggering policy. Signature is HMAC-SHA256 over the body keyed by `AXONFLOW_HITL_WEBHOOK_SIGNING_KEY`, sent as `X-AxonFlow-Signature: sha256=<hex>`. Delivery is async (never blocks the approve/reject response), retries on non-2xx at `5s/30s/5m`, and logs `[HITL.Webhook] OK|non-2xx|transport_err|GIVE-UP` lines per attempt. Closes #2419.

- **HTTP `Idempotency-Key` header dedup on the three integration endpoints.** `POST /api/v1/mcp/check-input` (agent), `POST /api/v1/audit/tool-call` (orchestrator), and `POST /api/v1/hitl/queue` (agent) now consume the `Idempotency-Key` header. A retry within 24h returns the cached response byte-for-byte plus an `Idempotent-Replayed: true` header. 2xx and 4xx responses are cached; 5xx is intentionally skipped so a caller's retry can hit a fresh attempt. Cross-tenant isolation is enforced by the row-level-security policy on the new `idempotency_keys` table (key + tenant_id + endpoint composite PK). Keys are validated against `^[A-Za-z0-9_.:\-/]+$`, max 256 chars; a malformed key produces a 400 before the handler runs. Closes #2420.

- **HITL `GET /api/v1/hitl/status` feature map advertises `notify_url: true` + `idempotency_key: true`** so the ADK plugin + n8n node can feature-detect at boot.

- **Schema changes.** Migration `114_hitl_notify_url.sql` adds `notify_url TEXT NULL` to `hitl_approval_queue`. Migration `115_idempotency_keys.sql` creates the `idempotency_keys` table with FORCE Row-Level Security keyed on `tenant_id = current_setting('app.current_tenant_id', true)` and a composite primary key on `(key, tenant_id, endpoint)`. Both ship a paired `_down.sql`. The dedup store is wired through `WithOrgAndTenantScope` (parity with the v9 Phase 8 wrap convention); the periodic sweep job runs hourly through the platform admin pool, deleting rows whose `expires_at` has passed.

### Fixed

- **HITL stale-request expiration now actually runs under FORCE Row-Level Security.** The 1-hour expiration ticker previously called `expire_hitl_requests()` against the agent's app-role pool with no `app.current_org_id` GUC set, so the cross-tenant scan silently matched zero rows — sister bug to the heartbeat path closed in v8.0.0. The ticker now routes through `OpenPlatformAdminConnection` per tick and uses the new `ExpireStaleAcrossTenants` path, which selects expiring rows with `FOR UPDATE SKIP LOCKED`, marks them `expired`, writes the history rows, and dispatches the new outbound webhook for any expired row that carried a `notify_url`. The legacy `ExpireStaleRequests` function is retained for back-compat with the `POST /api/v1/hitl/expire` HTTP path + existing tests.

### Configuration

- **`AXONFLOW_HITL_WEBHOOK_SIGNING_KEY`.** New env var (no default). Required to enable the outbound webhook — when unset, the dispatcher logs `[HITL.Webhook] DROP AXONFLOW_HITL_WEBHOOK_SIGNING_KEY=unset` per attempted delivery and the approve/reject response succeeds unchanged. Rotate by replacing the value and restarting; receivers should accept signatures from the prior key for the duration of their secret-sync cadence.

### Testing infrastructure

- **Cross-system HITL end-to-end harness.** Nine-probe script exercising the full `create → poll → approve/reject → webhook callback` lifecycle against a live platform stack. Covers both happy-path and error-class assertions (bad scheme, auth failure, missing required fields, 404 on unknown ID). CI-gated via the `Runtime E2E` workflow. Closes #2424.

## [8.0.1] - 2026-05-22 — CI green on community mirror (no runtime change)

Patch on top of v8.0.0. No platform behavior change; no migration impact; no SDK/plugin floor change. The [8.0.0] section below is the headline release.

### Fixed

- `TestBootLogCanonicalShape`, `TestProbeBootLogShimMatchesCanonicalShape`, `TestProductionPostureRegistryWellFormed`, and `TestEveryWriteIntoRLSTableIsWrapped` now run cleanly across all checkouts.
- `SDK Smoke Tests` and `Validate OpenAPI` workflows updated to pass on all checkouts.

## [8.0.0] - 2026-05-22 — v8 identity model enforcement + Row-Level Security default-on + cross-org admin routing

**Major-version cut.** v8.0.0 separates three previously-conflated identifiers — customer organization, API credential, and license deployment identity — and turns on Row-Level Security as the default tenant-isolation mechanism (FORCE RLS + non-owner application role) with cross-org admin routing for sweeps, recovery, and node-monitor workers. Pre-v8.0 the agent connected to the application database as the table owner, so RLS policies were defined but inert; v8.0.0 makes them load-bearing.

This is a major version because Row-Level Security enforcement changes the behaviour of direct SQL queries against the AxonFlow application database under the application role. **For customers using only the SDKs / plugins / HTTP API there is no breaking change** — JSON field names are unchanged, the `X-Tenant-ID` header is accepted as a deprecated alias, and Basic Auth credentials keep working. Existing v7.x SDKs (v8.0.0 SDK train) continue to work against v8.0.0 platform unchanged; the agent derives identity from Basic Auth when `X-Client-ID` is absent.

For the full mapping see the [v8 migration guide](https://docs.getaxonflow.com/docs/deployment/v8-to-v9-migration/).

### Breaking changes

- **`AXONFLOW_DB_USE_APP_ROLE` env gate, default `true`.** Agent + customer-portal connect to the application database as `axonflow_app_role` (NOBYPASSRLS) unless `AXONFLOW_DB_USE_APP_ROLE=false` is set explicitly. FORCE-RLS-protected tables return zero rows from any read that hasn't first set `app.current_org_id` via `set_config('app.current_org_id', '<value>', true)`. Verify before upgrade:
  1. `AXONFLOW_DB_APP_ROLE_URL` is set (or `DATABASE_URL` connects as the same role as master for dev / docker-compose).
  2. `AXONFLOW_DB_PLATFORM_ADMIN_URL` is set if any background worker iterates across orgs.
  3. All custom workers that iterate across orgs have been audited; they will silently return 0 rows under the app role.
  4. The `axonflow_app_role` + `axonflow_platform_admin` Postgres roles exist with `NOBYPASSRLS` / `BYPASSRLS` respectively (`scripts/operators/provision-app-role.sh` is the canonical bootstrap).
  Set `AXONFLOW_DB_USE_APP_ROLE=false` explicitly during a phased rollout to preserve v7.x semantics.

- **Direct SQL against the AxonFlow application database under the application role.** RLS is now enforced. SELECTs return zero rows unless `app.current_org_id` is set first. Use the `axonflow_platform_admin` role (or master) for legitimate cross-org access.

- **`middleware.RLSMiddleware` + `SetRLSContextForSession` + `ResetRLSContext` + `WithRLS` removed.** The four pool-scope GUC functions issued `SELECT set_org_id($1)` on the `*sql.DB` pool — pool-unsafe because the GUC landed on one connection and the next handler statement might run on a different one. Forks calling these directly must migrate to `withRequestOrgScope(r, h.db, fn)`. Diagnostic helpers (`GetCurrentOrgID`, `VerifyRLSActive`, `GetRLSStats`, `RLSHealthCheck`) retained.

### Identity model — three distinct identifiers

- **`RequestIdentity` + `ClientIDFromContext` + `X-Client-ID` header forwarding.** Agent derives identity once per request and exposes a structured accessor; `X-Client-ID` is the canonical API-credential header and is forwarded agent → orchestrator. The agent's auth middleware overwrites any caller-supplied `X-Client-ID` with its own auth-derived value before forwarding, so spoofed inbound headers have no effect. `X-Tenant-ID` accepted as deprecated alias through v8; planned removal in the next major.

- **Additive `client_id` schema + idempotent `org_id` backfill.** Migrations 088–095 add `client_id` columns to credential, audit, policy, execution, and service-identity tables; backfill `client_id = tenant_id` for hot-path credential tables; composite indexes `(org_id, client_id, timestamp/created_at)` on audit tables.

- **v8 compat aliases retained.** `tenant_id` columns kept as deprecated; `X-Tenant-ID` header accepted; SDK config `clientId` semantics unchanged. Slated for removal in the next major.

### Row-Level Security enforcement

- **`axonflow_app_role` (NOBYPASSRLS) + `axonflow_platform_admin` (BYPASSRLS) Postgres roles.** Application traffic runs as the non-owner app role; background workers that iterate across orgs use `axonflow_platform_admin`.

- **`WithOrgScope` transaction-scoped GUC.** `platform/agent/rls_session.go` `WithOrgScope` sets `app.current_org_id` per request transaction via `set_config('app.current_org_id', $1, true)` (third argument `true` = txn-local), guaranteeing isolation between concurrent requests on a shared connection pool.

- **`OpenPlatformAdminConnection()` helper.** New entrypoint in `platform/agent/db_connection.go` for cross-org workers to open a `*sql.DB` authenticated as `axonflow_platform_admin`. Asserts `current_user` matches on connect. Returns `nil, nil` when env unset (callers fall back to single-role behavior, with a startup-log declaration).

- **Main connection pools open via `OpenAppRoleConnection`.** Agent `authDB`, orchestrator `usageDB` + dynamic-policy + metrics + audit-logger pools, customer-portal main pool, and the connector-registry runtime pool all open through the helper, which resolves the DSN from `AXONFLOW_DB_APP_ROLE_URL` when `AXONFLOW_DB_USE_APP_ROLE=true` and asserts the connected role is `axonflow_app_role` at boot. Each pool emits a `current_user=<role> (UseAppRoleEnabled=<bool>, ...)` startup log line so a misconfigured DSN that silently falls back to the master role is caught at boot instead of bypassing RLS at runtime. Customer-portal's admin (BYPASSRLS) pool routes through `OpenPlatformAdminConnection` with the same role assertion. The connector-registry storage retains a one-shot master pool only for its `initSchema()` step (axonflow_app_role lacks DDL privileges); the master pool is closed immediately after schema init and runtime traffic uses the app-role pool exclusively. Orchestrator-side handlers that touch FORCE-RLS tables wrap their access via `withRequestOrgScope` / equivalent SECURITY DEFINER helpers, matching the customer-portal contract.

- **Local-dev docker-compose defaults to single-role mode.** `docker-compose.yml` + `docker-compose.enterprise.yml` pin `AXONFLOW_DB_USE_APP_ROLE=false` so the stack boots without role provisioning. Override to `true` after running `scripts/operators/provision-app-role.sh` to soak the production path locally.

- **Cross-org workers route through admin role.** `StartCommunitySaasSweep`, `RegisterCommunityRecoveryHandler`, and `NewNodeMonitor` now call `OpenPlatformAdminConnection` and use the admin DB for their cross-org queries. Each emits a startup log declaring admin-vs-fallback for verification. Self-hosted deployments running `COMMUNITY_SAAS_SWEEP_ENABLED=true` or `ENABLE_NODE_MONITOR=true` (or any fork with custom cross-org workers) must set `AXONFLOW_DB_PLATFORM_ADMIN_URL` before upgrade — without it, these workers silently return 0 rows under the app role.

- **Customer-portal handlers wrap FORCE-RLS table access.** `nodes.go`, `export.go`, `connectors.go`, `sso.go`, `auth/saml/service.go` now wrap reads/writes of `organizations`, `tenants`, `community_saas_registrations`, `sso_*`, and `connector_configs` in `withRequestOrgScope` / `withOrgScope`. SAML INSERTs populate `org_id` (migration 106 marks the column `NOT NULL`).

- **MCP cache-miss path stamps auth context.** `resolveMCPSession`'s cache-miss branch + `handleMCPInitialize` now capture `*Client` + `AuthKind` into the cached `mcpSession`. `requireMCPAuth` stamps the four auth context keys (`TenantID` / `OrgID` / `ClientID` / `AuthKind`) on `r.Context()` so MCP `tools/call` traffic sees the authenticated identity downstream — matching the REST middleware contract that the latent gap on this path had been missing.

- **FORCE RLS on audit, identity, config, and SSO tables.** Migrations 098, 099, 101, 102, 103, 106, 107 enforce row-level security on `deployment_upgrades`, `saml_configurations`, `audit_archive`, `mcp_query_audits`, `audit_retention_config`, `decision_chain`, identity tables (`custom_roles`, `role_assignments`, `service_identities`), `sso_configurations`, and additional config tables. First `FORCE ROW LEVEL SECURITY` in repo history; direct SQL against any of these tables under `axonflow_app_role` returns zero rows unless `app.current_org_id` is set first.

- **SECURITY DEFINER auth-bootstrap helpers.** Migrations 104, 108, and 109 introduce SECURITY DEFINER functions that bypass the FORCE-RLS chicken-egg for the auth-bootstrap step (the application role needs to read `customer_portal_api_keys` to authenticate the request that will then set `app.current_org_id`). Migration 104 ships `auth_lookup_api_key(text)` + `auth_touch_api_key(text)` for SELECT/UPDATE on the auth path; migration 108 ships the in-VPC variant for AWS deployments routing through a Lambda-side helper; migration 109 ships five additional helpers covering pre-auth `INSERT`/`UPDATE` paths (license claim, registration, telemetry-ack, etc.). All functions hardcode `search_path = pg_catalog, public` and are owned by `axonflow_platform_admin`.

- **Refuse-to-boot guard for `AXONFLOW_DB_USE_APP_ROLE=true` without `AXONFLOW_DB_PLATFORM_ADMIN_URL`.** The agent, orchestrator, and customer-portal binaries now exit on startup with a `FATAL` log line when `AXONFLOW_DB_USE_APP_ROLE=true` (the v8.0.0 default, also active when the env var is unset) and `AXONFLOW_DB_PLATFORM_ADMIN_URL` is not set. The previous behavior was a `WARNING` log followed by a silent fallback to the request-traffic pool, which under FORCE Row-Level Security caused cross-org workers (marketplace metering, community-saas sweep / recovery, node monitor, customer-portal admin handlers) to silently return zero rows. The FATAL log names both env vars so the configuration can be corrected without source diving. To preserve the legacy single-role posture, set `AXONFLOW_DB_USE_APP_ROLE=false` explicitly; the guard is a no-op under that flag.

### Migrations

- **`AXONFLOW_MIGRATIONS_PATH` env override.** Overrides the agent's hard-coded `/app/migrations/` Docker mount for deployments that don't use the canonical Docker layout. Leave unset for the standard Docker / `docker-compose` topology.

- **Migrations 042 + 069 made idempotent.** `CREATE INDEX IF NOT EXISTS` + `DROP TRIGGER IF EXISTS; CREATE TRIGGER` patterns make migrations safe to re-attempt when their `success=true` row is absent.

### Schema changes

- **`custom_roles.tenant_id` and `role_assignments.tenant_id` renamed to `org_id` (migration 111).** mig 023 (Nov 2025) created these two tables with a legacy `tenant_id` column predating the v8 identity rename. The RLS policies compared the column against the canonical `app.current_org_id` GUC, so the wraps elsewhere in this release worked — but the column/GUC mismatch was transitional. Migration 111 normalizes both tables to the canonical `org_id` column, recreates the RLS policy with the canonical `*_org_id_isolation` name shape, adds an explicit `WITH CHECK` clause (mig 023 specified `USING` only), and renames the dependent unique constraint (`uq_custom_roles_tenant_name → uq_custom_roles_org_name`) and indexes (`idx_custom_roles_tenant_id → idx_custom_roles_org_id`; same for `role_assignments`). `ALTER TABLE RENAME COLUMN` is data-safe (Postgres tracks column refs by `attnum`); the migration takes a brief `AccessExclusiveLock` on each table while the metadata flip and the DROP/CREATE POLICY run inside a single transaction. The Go-side `Role.TenantID` / `RoleAssignment.TenantID` struct fields rename to `OrgID` with `json:"org_id"` tags — direct consumers of the customer-portal roles API over HTTP must update their parsers; the customer-portal UI is unaffected (it never read the field).

### Administrative tooling

- **`scripts/operators/provision-app-role.sh`.** Reusable preflight script that idempotently creates `axonflow_app_role` + `axonflow_platform_admin` Postgres roles, grants the role-membership chain, and asserts `NOBYPASSRLS` / `BYPASSRLS` on the respective roles. Run before bumping `AXONFLOW_DB_USE_APP_ROLE=true`.

- **AWS CFN integration provisions `axonflow_app_role` automatically on stack deploys.** A new `provision-app-role` workflow runs as part of the AWS CFN deploy pipeline: it stages the role-bootstrap step against the deployment's RDS instance (deriving VPC + subnets from the RDS subnet group), gates the stack update on successful provisioning, and surfaces an `AppRoleProvisioned` CFN parameter so subsequent updates skip the step. Self-hosted AWS deployments no longer need to run the bash script by hand.

### Self-hosted upgrades

- **Keep `AXONFLOW_DB_USE_APP_ROLE=false` until you audit forks.** Stock v8.0.0 ships every hot-path write wrapped against FORCE RLS, but self-hosted deployments running customized or forked handlers (custom connectors, in-tree auth shims, fork divergence) must audit their write paths before flipping the env to `true`. Customized handlers that `INSERT`/`UPDATE` into Row-Level-Security-enabled tables without wrapping `WithOrgScope` or going through a SECURITY DEFINER helper will fail with `pq: new row violates row-level security policy`. The self-hosted preflight script gained a check that surfaces the env-pair requirement plus a customized-handler audit advisory; the [v8 migration guide](https://docs.getaxonflow.com/docs/deployment/v8-to-v9-migration/) gained a `Change 4` section detailing the audit recipe and the staged-rollout pattern.

### Security

- **Admin-API anonymous-callable fix.** Closed an admin-API endpoint that was anonymous-callable despite Basic Auth being declared in the OpenAPI spec; admin operations now require Basic Auth in all environments.

### Telemetry

- **`org_id` now included in SDK heartbeat payloads.** v8.1.0 SDKs (Go / Python / TypeScript / Java) + Rust v0.3.1 emit the caller's `org_id` alongside the existing instance / endpoint / deployment-mode fields. The platform's central heartbeat receiver tags incoming records with this value. `AXONFLOW_TELEMETRY=off` remains the sole opt-out and disables the heartbeat entirely. No other fields added; the previous v1 schema continues to work with v8.0.0 SDKs.

### Examples

- **End-to-end sweep across all five SDKs.** Every example in `platform/examples/` exercised end-to-end against a live agent with Go, Python, TypeScript, Java, and Rust SDKs. Examples that depended on stale env-var names, removed flags, or pre-v8 license shapes refreshed to match v8.0.0 platform behavior.

### SDK + plugin floor (advertised by `/health`)

- **Min SDK v8.0.0 (unchanged).** v8.0.0 SDK callers keep working against v8.0.0 platform — agent derives identity from Basic Auth when `X-Client-ID` is absent.
- **Recommended SDK v8.0.0.** v8.1.0 SDKs (Go / Python / TypeScript / Java) + Rust v0.3.1 are on each SDK's `main` carrying the `X-Client-ID` outbound emission, but not yet released to registries. Recommended will bump to v8.1.0 / v0.3.1 once the SDKs tag + publish.
- **Min plugins openclaw v2.4.0 / claude-code v1.4.0 / cursor v1.4.0 / codex v1.4.0 (unchanged).** Recommended unchanged.

## [7.9.0] - 2026-05-09 — Decision History API + policy_version recorded on every decision

**Decision-record release.** Closes the loop on programmatic decision audit:
callers can now `list` recorded decisions, `explain` any specific one, and
read the policy version that was active at decision time. The complete
read-side audit surface (list + explain + version provenance) is enough for
"show me everything we blocked yesterday and why" workflows without operators
leaving the API.

No breaking changes for self-hosted Enterprise deployments.

### Community

#### Added

- **`GET /api/v1/decisions` list endpoint** for paging recorded policy decisions. Companion to `/api/v1/decisions/{id}/explain` shipped in v7.4.0 — callers can now both list and drill in. Tier-aware caps (Free 24h × 5; Pro 30d × 100; Self-hosted Evaluation 14d × 100; Self-hosted Enterprise full retention × 1000).
- **`list_recent_decisions` MCP tool** wraps the new list endpoint so the AI in any host CLI can answer "what just got blocked?" inline without the user leaving their tool surface. Same tier caps as the HTTP endpoint.
- **`policy_version_at_decision` on the explain response.** Records and surfaces the policy version that was active when the decision was made — an audit drill-in shows not just *which* policy fired but the exact rule text the decision was made against. Crucial for compliance reviews of decisions made before a policy was edited. Additive field; existing readers ignore it cleanly.

#### Telemetry

- **Anonymous platform startup heartbeat (agent + orchestrator).** One classification-only ping per binary per 7 days; single opt-out `AXONFLOW_TELEMETRY=off`; disclosure line printed on every send. Closes the gap where `docker compose up` deployments that never instantiate an SDK looked invisible to adoption analytics.
- **v1 schema additions on `POST /v1/ping`** — additive `telemetry_type`, `component`, `license_tier`, `environment_class`, `stream` fields with closed-enum normalization on both sides. `"rust"` joins the language-SDK allowlist. Existing SDK / plugin pings continue working unchanged.

#### Fixed

- **Community-SaaS daily-cap 429 events now persist with full attribution.** Previously the auth middleware populated the telemetry tenant_id after the daily-cap check, so rate-limit rejections terminated before attribution and the telemetry table was blind to the very rejections it should have been counting. Tenant_id now resolves immediately after auth, before the daily-cap gate, so every 429 event ingests with full attribution.

## [7.8.0] - 2026-05-07 — V1 Plugin Pro graduated freemium + structured upgrade envelope + 5 new MCP tools + Rust SDK announcement

**V1 Plugin Pro completion release.** Builds on v7.7.0's launch with the graduated freemium model that turns every Free-tier limit into a conversion moment instead of a dead-end 401/429. Pro buyers now get the right caps everywhere, MCP governance traffic counts against daily quota, and a structured upgrade envelope replaces five different per-route ad-hoc 429 bodies with one wire shape that all four plugins parse identically. No breaking changes for existing self-hosted Enterprise deployments; Free / Pro / Premium SaaS Plugin tiers all keep their v7.7.0 wire shape, plus richer fields.

**5th SDK live — Rust preview at v0.1.0.** First-ever AxonFlow Rust SDK shipped 2026-05-05 to [crates.io](https://crates.io/crates/axonflow-sdk-rust) covering proxy + audit + basic MAP + basic MCP + OpenAI interceptor. Repo: [getaxonflow/axonflow-sdk-rust](https://github.com/getaxonflow/axonflow-sdk-rust). Quickstart: [docs/sdk/rust-quickstart.md](docs/sdk/rust-quickstart.md). Foundation contributed voluntarily by Francesco Pierfederici.

**V1 customer-facing surfaces in this release:**

- **Five Pro differentiators, all enforced.** Daily quota (Free 200 → Pro 2,000), audit retention (Free 3d → Pro 30d), custom tenant policies (Free 2 active → Pro unlimited), HITL approvals (Free 1 per rolling 7d → Pro unlimited), LLM cost pre-flight (Pro only). Existing Pro buyers automatically receive the higher daily-quota cap on this release.
- **Structured upgrade envelope across every Free-tier limit hit.** One JSON shape (`{error, limit_type, tier, limit, remaining, window, resets_at, upgrade.{tier, wording, compare_url, buy_url}}`) on 429 daily-quota AND 403 graduated / Pro-only paths. Three locked headers (`X-Axonflow-Tier-Limit`, `X-Axonflow-Upgrade-URL`, `Retry-After`). Plugin parsers read the same envelope on the HTTP path and on the JSON-RPC path (where it rides inside `result.content[0].text` with `isError: true`).
- **Five new MCP tools on `/api/v1/mcp-server`.** `axonflow_get_tenant_id` (Free + Pro), `axonflow_request_approval` (Free 1 per rolling 7d, Pro unlimited), `axonflow_create_tenant_policy` (Free 2 active max, Pro unlimited), `axonflow_get_cost_estimate` (Pro only — wraps `/api/v1/plans/estimate`), `axonflow_list_pro_features` (data only, all tiers). All five carry an explicit `success: true` field so LLM consumers in Cursor / Claude Code / Codex / OpenClaw see an unambiguous positive signal on every successful call.
- **Tier-aware `tools/list` filtering.** Free callers see N tools, Pro callers see N+M. Honest visibility — `axonflow_get_cost_estimate` does not appear in a Free user's tool list at all (not just rejected on call).

**Companion plugin release planned at v1.3.0 / v2.3.0** with envelope-aware error handling (parse → display → honor `Retry-After`) and skill / README mentions of the new MCP tools. Plugin tags + npm / ClawHub publishes follow on their own release schedule.

**Stable SDKs (Go / Python / TypeScript / Java) unchanged at v7.1.0.** Existing SDK callers inherit the higher Pro daily quota with zero code change — V1 Plugin Pro is server-side and plugin-side only.

### Community

#### Added

- **Tier-gating framework on MCP tools.** Tool definitions can now declare `RequiredTier` ("Pro" / "Premium") which drives `tools/list` filter visibility and `tools/call` dispatch rejection, and `FreeUsageLimit` which enforces graduated-cap behavior — `MaxCount` for object-creation limits ("2 active custom policies") and `WindowSeconds` + `MaxInWindow` for rolling-window action limits ("1 HITL approval per 7 days"). Both fields default zero / nil so every existing tool is unchanged.
- **Structured V1 upgrade envelope.** One shape across HTTP (429 daily-quota, 403 active-policies / hitl-approvals / feature-pro-only) and JSON-RPC (wraps the same envelope inside `result.content[0].text` with `isError: true`). Locked URLs `https://getaxonflow.com/pricing/` (compare) + `https://buy.stripe.com/bJe28qbztcdVchjdkw8k800` (buy) are the single source of truth across agent code, license email body, Stripe Dashboard, and customer-facing landing pages.
- **`axonflow_get_tenant_id` MCP tool.** Returns `{success, tenant_id, tier, upgrade_url, buy_url}`. The AI in any host CLI can answer "what's my tenant ID?" / "what tier am I on?" inline without running a shell script — replaces the per-plugin discovery scripts with auto-discovered MCP tool dispatch.
- **`axonflow_request_approval` MCP tool.** Inline HITL approval gate before risky operations (e.g. `rm -rf`, `git push --force`, production deploy). Free tier supports 1 approval per rolling 7-day window; Pro unlimited.
- **`axonflow_create_tenant_policy` MCP tool.** Lets the AI create tenant-scoped governance policies on the fly — *"block any tool call that writes to ~/.ssh/"*, *"require approval for any `rm -rf`"*. Free tier supports 2 active policies (delete to make room); Pro unlimited.
- **`axonflow_get_cost_estimate` MCP tool.** LLM cost pre-flight before running multi-step plans — the headline anti-runaway-bills feature. Pro tier only; Free callers see the tool filtered out of `tools/list`. Wraps the orchestrator's `/api/v1/plans/estimate` so per-token pricing follows the orchestrator's authoritative pricing config — no drift between proxy enforcement and tool-reported estimate.
- **`axonflow_list_pro_features` MCP tool.** Returns the V1 Pro feature list as data — five differentiators, exact pricing, tone-direction quote — so a Free user's AI can faithfully answer "what would I get if I upgraded?" without reading docs.
- **Daily-cap enforcement on every governance route.** Three previously-leaking routes — `/api/v1/mcp-server tools/call`, `/api/v1/mcp/check-input`, `/api/v1/mcp/check-output` — now consume daily quota and emit the V1 envelope on rejection. Pre-fix: Free tenants could get unlimited governance evaluation by routing through MCP. Post-fix: every governed event counts.
- **`success: true` field on every V1 MCP tool response.** Plus companion `submitted: true` / `awaiting_review: true` on `axonflow_request_approval` and `created: true` on `axonflow_create_tenant_policy` so LLM consumers don't misread `status: "pending"` (HITL row state) or `enabled: true` (policy state, not operation outcome) as failure. Locks unambiguous tool-success semantics for AI consumers across host CLIs.
- **Telemetry stream classifier.** Every heartbeat row tagged `Stream=heartbeat` so the SDK / plugin heartbeat stream and a future Community SaaS operational stream remain distinguishable when both flow through the same telemetry pipeline.

#### Changed

- **Pro daily quota 1,000 → 2,000.** Existing Pro buyers automatically receive the higher cap on this release. Heaviest observed Free-tier daily volume in the week leading up to release was ~780 events for a single power user; 2,000 leaves comfortable headroom for a Pro user's normal day.
- **MCP `tools/list` is tier-filtered.** Free callers see N tools (Pro-only ones omitted); Pro callers see N+M. The filter is honest visibility, not security — `tools/call` dispatch re-enforces the gate so a determined Free caller invoking by name still gets the structured rejection envelope.
- **All daily-cap-exceeded responses now emit the V1 envelope.** Auth-path and proxy-path rejection bodies used to differ in shape for the same condition (one wrapped, one flat); both now emit the V1 envelope verbatim. Plugins or direct API consumers that previously parsed the auth-path's nested `{error: {code, message}}` shape will need to update to read the V1 envelope's top-level `error` string + richer surrounding fields — the v1.3.0 / v2.3.0 plugin train carries the parser change on the client side.
- **`AXONFLOW_TELEMETRY=off` scope clarified in docs.** Controls the SDK / plugin heartbeat path only. Community SaaS operational data (registrations, audit logs, policy-enforcement records, request-header metadata) is processed inherent to running the hosted service and is independent of the heartbeat opt-out.

#### Fixed

- **Apache Thrift CVE-2026-41602 (HIGH — Integer Overflow).** Indirect dependency `github.com/apache/thrift` bumped from v0.22.0 to v0.23.0 via the Snowflake connector chain.

### Enterprise

#### Changed

- **`RecommendedPluginVersion` advertised in `/health`** bumps to claude / cursor / codex 1.3.0 and openclaw 2.3.0. `MinPluginVersion` floors stay at 1.0.0 / 2.0.0 — pre-1.x plugins ran the pre-DNT-removal contract and remain blocked; pre-V1-Plugin-Pro plugins continue to work but log an actionable upgrade warning on every governed call.
- **`RecommendedSDKVersion` unchanged at v7.1.0.** This release is server-side and plugin-side only; the `X-Axonflow-Client` header semantics + scope-aware license validation that v7.1.0 SDKs already speak cover all V1 Plugin Pro paths.

## [7.7.0] - 2026-05-06 — V1 SaaS Plugin Pro launch + free-tier credential recovery + license matrix

**V1 launch release.** First public release of the paid Pro tier and credential recovery for AxonFlow Community SaaS. Self-hosted deployments are unaffected; existing Self-Hosted licenses keep validating via the documented backward-compat path.

**V1 customer-facing surfaces shipping together:**

- **Paid Pro tier ($9.99 one-time, 90 days).** Stripe Checkout success mints
 an Ed25519-signed plugin license token, persists it on the tenant, and
 emails it to the buyer. The token paste activates Pro features immediately
 on every governed request through the plugin. Full Stripe refunds within
 the 14-day window auto-revoke the license; partial refunds are an explicit
 no-op.
- **Free-tier credential recovery.** A Community SaaS tenant who opted into
 recovery at sign-up time can self-recover a lost secret via emailed magic
 link. Capped at 3 active tenants per email; per-IP rate limit prevents
 enumeration probes.
- **GDPR right-to-erasure.** Two-step email-verified tenant deletion
 atomically scrubs registration, license, audit history, daily-usage
 counters, and per-tenant usage records. An immutable deletion log row
 survives the cascade for Article 30 compliance.

**Companion plugin and SDK release.** All four plugins
(axonflow-claude-plugin, axonflow-cursor-plugin, axonflow-codex-plugin)
advance to v1.2.0 and axonflow-openclaw-plugin advances to v2.2.0. All
four stable SDKs (Go, Python, TypeScript, Java) advance to v7.1.0 with
the new `X-Axonflow-Client` header and scope-aware license validation.
Existing v7.0.x SDK / v1.1.x plugin callers continue to work without
the header — they receive a one-time upgrade hint. (Per-version detail
in the Plugin / SDK release-companion sections below.)

No breaking platform changes for existing self-hosted Enterprise tenants.
Existing license tokens validate cleanly via the missing-`aud` fallback
documented in the License Matrix below.

### Community

#### Added

- **`POST /api/v1/billing/stripe-webhook`** — Stripe webhook receiver for
 the V1 SaaS Plugin Pro tier. Subscribes to `checkout.session.completed`
 (issues the license) and `charge.refunded` (revokes on full refund).
 Defended by Stripe-Signature HMAC + IP allowlist (Stripe's published
 webhook CIDRs, env-overridable) + per-source rate limit (60 req/min
 default). `GET` returns 405 so misconfigured webhook URLs in the Stripe
 Dashboard fail loudly. Idempotent over `stripe_session_id` — Stripe's
 at-least-once delivery returns the original token byte-identically on
 retry, never a new one.
- **License token validation on every governed request.**
 `validateCommunitySaasAuth` now reads `X-License-Token`, validates the
 Ed25519 signature, checks the token's audience claim against the SaaS
 Plugin accept list, verifies the tenant binding matches the auth-resolved
 tenant, and looks up the active row in `plugin_user_licenses`. Free tier
 (no header) passes through unmodified; Pro / Premium tier promotes the
 request when both token and row are valid. Per-request DB lookup keeps
 revocation effective within ~60s of a chargeback or dispute. Token
 tenant_id mismatch returns 403; missing/revoked row returns 401; DB
 unavailability returns 503 so the plugin retries rather than silently
 degrading to Free.
- **Per-tenant daily request quota.** Daily event quota now follows the
 resolved tier from the license token: Free 200/day, Pro 1,000/day,
 Premium 5,000/day (reserved, not yet sold). Quota fires on both admin
 routes (`apiAuthMiddleware`) and plugin / SDK governed routes
 (`/api/v1/process`, `/api/v1/audit/*`, `/api/v1/mcp/evaluate-policies`,
 `/api/v1/connectors`). The legacy `COMMUNITY_SAAS_DAILY_LIMIT` env var
 is preserved as a fallback for callers without a resolved tier
 (perf-testing rigs, etc.).
- **Per-tenant audit retention.** Audit log cleanup now buckets tenants by
 retention tier — Free 3 days, Pro 30 days, Premium 90 days (reserved).
 Self-hosted deployments without the SaaS schema fall through cleanly
 via a `relation does not exist` guard on the SaaS table.
- **`POST /api/v1/recover`** — request a magic-link recovery email for a
 Community SaaS tenant bound to a given email. Always returns 202
 (anti-enumeration); the delivered email contains a single-use 15-minute
 magic link.
- **`POST /api/v1/recover/verify`** — consume a magic-link token and
 receive fresh credentials bound to the same email. `GET` on the same
 path serves an HTML confirmation page (no state change) so email-link
 prefetchers don't burn the token.
- **Email field on `POST /api/v1/register`** so Community SaaS registrants
 can opt into recovery at sign-up time.
- **`POST /api/v1/tenant/<id>/delete-request`** +
 **`POST /api/v1/tenant/<id>/delete-confirm`** — GDPR right-to-erasure
 endpoints. `delete-request` accepts the email-on-file and emails a
 single-use 1-hour confirmation token; `delete-confirm` consumes the
 token and atomically scrubs the tenant from the SaaS registration table,
 license table, audit logs, daily-usage counter, and usage events. Stripe
 customer archive runs best-effort post-commit (DB-side erasure completes
 regardless of Stripe reachability). Per-IP (1/min) and per-tenant
 (1/hour) rate limits prevent spam. Tokens stored as HMAC-SHA256 (with
 optional `AXONFLOW_TENANT_DELETE_TOKEN_PEPPER` for at-rest hardening).

#### Changed

- **License Matrix — explicit `aud` claim per hosting-mode × scope.** Six
 canonical audience values now describe the matrix:
 `axonflow.{saas,self_hosted}.{plugin,sdk,full}`. Each license-validation
 context (SaaS Plugin path, SaaS SDK path, self-hosted loader) ships an
 explicit accept list — cross-quadrant misuse (e.g. a SaaS Plugin Pro
 token pasted into `AXONFLOW_LICENSE_KEY`, or a self-hosted Enterprise
 license sent as `X-License-Token`) is rejected at the validator
 boundary with an explicit reason. **Existing tokens predating the
 rename have empty `aud` and validate via a documented fallback to
 `axonflow.self_hosted.full` — no production breakage on upgrade.** Two
 new helpers (`HostingMode()` and `HasScope(scope)`) on the parsed
 license payload derive the matrix coordinates so callers don't
 string-parse inline. The deprecated `origin` claim (redundant with
 the new `aud`) is no longer set on newly issued tokens or read by
 validators.
- **SaaS Plugin tier rename + schema simplification.** Internal V1
 paid-tier names `plugin-claimed` and `plugin-subscription` rename to
 `Pro` and `Premium`, with a new `Free` baseline applied when no
 `X-License-Token` is sent. Per-tier limits move out of a JSONB blob
 and into a typed struct shared with the self-hosted ladder. The
 forward-only schema migration drops the JSONB column, renames any
 existing rows, and tightens the tier CHECK constraint. No production
 tokens existed for the prior design; staging fixtures re-seed cleanly
 under the new schema.
- **Stripe webhook now issues 90-day Pro tokens by default.**
 Configurable per-deploy via `AXONFLOW_BILLING_PRO_VALIDITY_DAYS`;
 per-tenant token validity is independent of the plugin install
 lifetime.
- **Eval-license endpoint mints a quadrant-aware token.** The
 `/api/evaluation-license` Cloudflare Pages Function on `getaxonflow.com`
 now sets `aud` explicitly per the originating form: the platform
 Self-Hosted Eval form at `/evaluation-license` mints
 `axonflow.self_hosted.full`; the Plugin In-VPC Eval form at
 `/plugins/evaluation-license` mints `axonflow.self_hosted.plugin`.
 Existing eval tokens issued before this release validate unchanged
 via the missing-`aud` fallback.
- **Cross-quadrant license rejection.** A self-hosted Enterprise
 license sent as `X-License-Token` on a SaaS request is now rejected
 at the validator boundary with an explicit "wrong hosting mode"
 reason instead of silently failing further down the stack.

#### Fixed

- **Stripe webhook idempotency held only on the day a token was issued.**
 The token's payload `IssuedAt` came from `time.Now()` while the
 persisted row's `issued_at` defaulted to the DB's `NOW()` and was read
 back via `RETURNING`. A replay landing on a different UTC day produced
 a byte-different re-minted token, breaking the V1 Stripe-retry
 guarantee. Issuer now passes `IssuedAt` explicitly into both the
 token and the INSERT so the persisted value matches what the token
 signs.
- **`POST /api/v1/audit/search` returns `entries: []` (not `null`) on
 empty result sets.** Iteration code that walked the array
 (`for entry of entries`) or read its length without a null guard now
 works correctly. Callers that already handled the null case remain
 compatible.
- **`POST /api/v1/overrides` rejects critical-severity system policies
 with HTTP 403.** Authentication-bypass, time-based blind SQL injection,
 stacked DROP/DELETE/UPDATE/INSERT/EXEC patterns, government IDs, and
 financial PII patterns are no longer overridable. Pre-existing active
 overrides on these policies are revoked at upgrade time.
- **Per-tenant daily cap fires on plugin / SDK governed routes.**
 Previously the cap was only enforced on admin routes; plugin and SDK
 traffic flowing through `/api/v1/process`, `/api/v1/audit/*`,
 `/api/v1/mcp/evaluate-policies`, and `/api/v1/connectors` was
 effectively un-capped. The cap now mirrors onto these proxy routes
 with the same per-tenant tier-aware limit and the same HTTP 429
 response shape.
- **Per-IP rate limits behind ALB now key on the trusted last-hop IP.**
 Community SaaS register and recovery rate limits previously read the
 first `X-Forwarded-For` entry, which is client-controlled behind
 AWS ALB; the limits now read the last entry (the ALB-observed peer
 IP) so spoofed first-entry values cannot bypass the per-IP cap.
- **AWS Secrets Manager-derived secrets are trimmed at boot.**
 RESEND_API_KEY, STRIPE_WEBHOOK_SIGNING_SECRET,
 AXONFLOW_INTERNAL_SERVICE_SECRET, JWT_SECRET, and LLM provider API
 keys are read via a dedicated helper that strips trailing whitespace.
 SM-CLI-quirky values with stray newlines previously caused
 Authorization-header rejection or HMAC mismatch in confusing ways at
 first request.

#### Documentation

- **License Matrix architecture decision** documents the
 six-quadrant license model, per-context accept lists, and the
 missing-`aud` backward-compat fallback used by every existing
 self-hosted token.
- **V1 paid Pro tier integration guide** covering Stripe Checkout setup,
 webhook configuration, license token format, plugin-side activation,
 and the refund window. Included in `docs/api/agent-api.yaml` for the
 Community Stripe webhook endpoint.

#### CI / Testing

- **Definition-of-Done CI gate.** Every PR that touches user-facing
 surface (platform, ee/platform, migrations, docs/api) must include a
 corresponding `runtime-e2e/` test that exercises the change against a
 live agent + DB stack. Skipped via `[skip-runtime-e2e]` PR title prefix
 + a justification block in the PR body for build / deps / lint /
 connector-builder tooling changes.
- **License-flow runtime E2E** (the runtime test bundle) drives the
 full Stripe-checkout → token-issued → email-delivered →
 plugin-uses-token path against a Docker community-saas stack.
- **Tenant-durability runtime E2E** (the runtime test bundle)
 asserts a Community SaaS tenant survives an agent-container restart
 because the tenant row lives in Postgres.
- **Free-tier recovery runtime E2E** (the runtime test bundle) drives
 the magic-link recovery flow end-to-end including the post-recovery
 audit-write check.

### Operator

- **`AXONFLOW_BILLING_PRO_VALIDITY_DAYS`** — override the 90-day default
 Pro license validity. Bad / non-positive values fall through to the
 default rather than failing boot.
- **`AXONFLOW_BILLING_FROM_EMAIL`** — override the from-address on
 post-purchase license-delivery emails (default
 `AxonFlow <hello@getaxonflow.com>`).
- **`AXONFLOW_PLUGIN_CLAIMED_PUBLIC_KEY`** — verifier-only split. When
 set, the agent verifies plugin tokens without holding the signing
 seed; only the issuer service holds the seed. Recommended production
 posture so a runtime compromise of the agent cannot mint forged
 tokens. Backward-compatible: when unset, the agent derives the
 pubkey from the existing signing-key env var.
- **`AXONFLOW_STRIPE_WEBHOOK_IP_ALLOWLIST`** +
 **`AXONFLOW_STRIPE_WEBHOOK_RATE_PER_MIN`** — knobs for tuning the
 Stripe webhook IP allowlist (default = Stripe's published webhook
 CIDRs) and per-source rate limit (default 60/min).
- **`AXONFLOW_TENANT_DELETE_TOKEN_PEPPER`** — optional pepper for the
 at-rest HMAC of GDPR-deletion confirmation tokens.
- **AWS Marketplace template** (`cloudformation-ecs-fargate.yaml`)
 gains an optional `StripeWebhookSecretArn` parameter that wires the
 agent container's `STRIPE_WEBHOOK_SIGNING_SECRET` env var from a
 Secrets Manager ARN. Default empty (Stripe-paid tier disabled, agent
 webhook handler exits early). The IAM TaskExecutionRole grants
 `secretsmanager:GetSecretValue` on the supplied ARN only when set,
 so customers running the marketplace template without Stripe see no
 policy bloat.
- **CloudWatch alarms for Stripe billing** attach three
 metric-filter-driven alarms to the agent log group: webhook delivery
 failures (≥5 in 5 min → page), license issuance failures (1 in 1
 min → page — money taken without service delivered), and a
 first-payment milestone (1 in 1 min → separate SNS topic for the
 launch celebratory ping). Gated by `EnableStripeAlarms=true`
 (default) so staging stacks can opt out.
- **Synthetic monitoring canary.** Stand-alone CFN stack deploys a
 Python Lambda that runs hourly via EventBridge and exercises
 `/api/v1/register` → `/api/v1/mcp-server` → `/api/v1/audit/search`
 end-to-end against the public community-saas endpoint. Failures
 publish a structured failure report to a dedicated SNS topic.

### Evaluation

- All Community changes apply.
- Self-Hosted Evaluation licenses continue working unchanged. The
 `/api/evaluation-license` issuance endpoint now stamps the explicit
 `aud` claim per the originating form (Self-Hosted Full vs. Plugin
 In-VPC), but tokens issued before this release validate cleanly via
 the missing-`aud` fallback.

### Enterprise

- All Community + Evaluation changes apply.
- No Enterprise-only behaviour changes in this release. The portal,
 customer-portal-ui, and the rest of the Enterprise tree pick up the
 Community-side fixes (license matrix validators, daily-cap on proxy
 routes, secret-trimming) automatically.

### SDKs

- **Go SDK v7.1.0** — `axonflow-sdk-go@v7.1.0`. Sends `X-Axonflow-Client`
 on every governed request; SDK identifies itself by the canonical
 `sdk-go/<version>` pattern.
- **Python SDK v7.1.0** — `axonflow>=7.1.0`. Same `X-Axonflow-Client`
 injection.
- **TypeScript SDK v7.1.0** — `@axonflow/sdk@^7.1.0`. Same.
- **Java SDK v7.1.0** — `<version>7.1.0</version>`. Same.

The `X-Axonflow-Client` header is consumed by the agent's scope
validator: a SaaS Plugin Pro token paired with an SDK client header is
rejected at the validator boundary, and vice versa. Existing v7.0.x
callers continue to authenticate without the header — the agent emits
a one-time upgrade hint per process and treats the request as `full`
scope.

axonflow-sdk-rust remains at v0.1.0 (preview). The `X-Axonflow-Client`
header support lands in a future preview release.

### Plugins

- **OpenClaw v2.2.0** — `npm install @axonflow/openclaw@^2.2.0`. Sends
 `X-Axonflow-Client: openclaw/<version>` on every governed agent
 request. Pro license token paste via
 `clawhub config set license-token <token>` activates Pro features
 immediately.
- **Claude Code plugin v1.2.0** — graduates from the v1.1 line. Sends
 `X-Axonflow-Client: claude-code/<version>`. License token paste via
 `/axonflow login --token <token>`.
- **Cursor plugin v1.2.0** — graduates from the v1.1 line. Sends
 `X-Axonflow-Client: cursor/<version>` via `mcp.json` `headers` field.
 License token paste via Cursor settings (`AXONFLOW_LICENSE_TOKEN`).
- **Codex plugin v1.2.0** — graduates from the v1.1 line. Sends
 `X-Axonflow-Client: codex/<version>` via `.mcp.json` `http_headers`
 block. License token paste via `~/.codex/axonflow.toml`.

All four plugins continue to query `/health` at startup and emit a
one-time upgrade hint when the agent's `min_plugin_version` floor is
above the plugin runtime.

## [7.6.0] - 2026-05-02 — Policy-engine response cleanup + per-category enforcement controls

MINOR release. Adds new API surfaces on the marketplace CFN template and
on the policy enforcement response, plus two bug fixes on the audit-trail
side. No breaking changes; existing SDK / dashboard consumers continue
to work.

**Bug fixes:**

- **`policy_info` no longer reports duplicate matched policies.** When a
 policy's pattern matched both the query string and a request parameter,
 the response field listed the same policy twice (e.g.
 `["sys_sqli_grant", "sys_sqli_grant"]`). Each policy is now reported
 once per evaluation regardless of how many contexts it matched in.
 Block-decision behaviour is unchanged.
- **`sys_pii_booking_ref` no longer fires on SQL keywords.** The original
 pattern `\b[A-Z0-9]{6}\b` matched any 6-char alphanumeric token,
 including SELECT, INSERT, DELETE, UPDATE, CREATE — generating a
 booking-reference audit-log entry for every benign SQL query and
 inflating "PII detected" counts in compliance dashboards. The pattern
 now requires a booking-context label (booking, reservation, reference,
 ref, pnr, confirmation, conf) before the alphanumeric token. Real
 booking refs like `booking ABC123` or `PNR XYZ789` continue to match.
 Action remains `log` — requests are not affected, only audit-trail
 noise. A follow-up SQL migration (074) updates already-deployed
 systems in place; new deployments seed the corrected pattern from
 the start.

**API additions:**

- **`policy_info.matched_policies` field added** alongside the existing
 `policies_evaluated`. The new field name is the canonical one; the
 legacy `policies_evaluated` is kept populated with the same values
 for backward compatibility and will be removed in the next major
 release. The original field name suggested "every policy the engine
 ran against the input" but the value has always been the matched-
 policies list — the new name reflects what's actually reported.

**Enterprise:**

- **Per-category detection action overrides on the marketplace CFN
 template.** Self-hosted enterprise stacks gain four new optional
 CloudFormation parameters — `SQLIAction`, `PIIAction`,
 `SensitiveDataAction`, `DangerousQueryAction` (each: `block` / `warn` /
 `log`, `PIIAction` also accepts `redact`). Empty leaves the active
 `AXONFLOW_PROFILE` default in place; setting one overrides only that
 category without flipping the global profile. Lets operators tighten
 enforcement on a single category (e.g. `SQLIAction=block` for a
 benchmark stack) without inheriting the strict profile's PII redact
 behaviour. No change for existing deployments — the parameters
 default to empty.

- **Per-category circuit breaker threshold overrides on the
 marketplace CFN template.** Two new optional CloudFormation
 parameters — `CBErrorThreshold` and `CBPolicyViolationThreshold`
 (integers) — let operators tune the agent's per-client circuit
 breaker without forking the template. Production defaults stay
 at the Article-14 posture (10 errors / 20 policy violations per
 5-min window per client); empty values leave defaults in place.
 Useful for benchmark stacks running attack-pattern load that would
 otherwise trip the breaker after the first second.

## [7.5.0] - 2026-04-29 — Production, quality, and security hardening — upgrade encouraged

**Upgrade strongly recommended.** Over the past month we've shipped substantial
production, quality, and security hardening across the AxonFlow platform —
upgrade for a more secure, reliable, and bug-free experience.

**Security highlights from this release cycle:**
- **Multi-tenant isolation in MAP execution** (v7.4.5). A body-supplied
 `org_id` could override the authenticated org for both recording AND
 policy evaluation. Identity is now sourced from authenticated headers
 consistently across recording, read filters, and policy evaluation.
- **SQL-injection enforcement restored on `try.getaxonflow.com`** (v7.5.0).
 The Community SaaS endpoint had inherited the `warn` default since
 v6.2.0; SQLi-shaped requests passed through to the LLM. Default flipped
 back to `block`; configurable per deploy.
- **Cross-tenant audit-log isolation** (v7.2.0). Evidence and explain
 handlers fail-closed when tenant context is missing instead of
 returning data scoped to a different tenant.

The full set of platform-side security fixes addressed in this cycle —
including five additional access-control and DoS hardening items not
listed above — is documented in the consolidated security advisory
[GHSA-9h64-2846-7x7f](https://github.com/getaxonflow/axonflow/security/advisories/GHSA-9h64-2846-7x7f).

**Reliability and bug-fix highlights:**
- **`/health` now reports the deployed platform semver** (v7.5.0). Was
 returning `1.0.0` on every deployed stack because the image tag
 failed the version-resolver regex. New `PlatformVersion` CFN parameter
 + repo-root `VERSION` file as single source of truth.
- **ALB idle timeout 300s on Community SaaS** (v7.5.0). Long MAP plan
 generation requests no longer 504 at the load balancer before the
 orchestrator finishes.
- **`decision_id` on every governance decision path** (v7.5.0).
 Allow paths on `/api/v1/mcp/check-input` and `/api/v1/mcp/check-output`
 no longer silently drop the audit correlator; every allow / deny /
 redact decision now surfaces `decision_id` for forensic correlation.

No breaking platform changes. Existing SDK and plugin callers continue
to work; they receive a one-time upgrade hint when they sit below the
new floor.

### SDKs and Plugins

Coordinated major-version bump across all eight artifacts. The four
SDKs (Go, Python, TypeScript, Java) advance to **v7.0.0**. The OpenClaw
plugin advances to **v2.0.0**; the Claude Code, Cursor, and Codex CLI
plugins graduate from `v0.x.x` to **v1.0.0**. The breaking change
driving all eight is the `DO_NOT_TRACK` telemetry opt-out removal —
`AXONFLOW_TELEMETRY=off` is now the canonical and only opt-out across
every SDK and every plugin.

### Community

#### Added

- **`/health` advertises plugin version compatibility.** New
 `plugin_compatibility` field declares `min_plugin_version` and
 `recommended_plugin_version` per plugin id (`openclaw`, `claude-code`,
 `cursor`, `codex`), mirroring the long-standing `sdk_compatibility`
 shape. Plugins query `/health` at startup, log a one-time upgrade
 warning when they're below the floor, and stay quiet otherwise — the
 same downgrade-warning gate every SDK already runs. The
 `HealthResponse` OpenAPI schema gains the new field; older platforms
 without the field degrade silently on the plugin side.
- **Community-SaaS registration lifecycle.** Registration TTL bumped
 from 30 days to 1 year; existing 30-day registrations within 60 days
 of expiry are auto-extended at deploy time so no live tenant gets
 locked out. New tombstone semantics keep the `tenant_id` slot
 reserved indefinitely after a cascade-delete so a UUID is never
 reused, and a distinct `ErrRegistrationTerminated` error returns an
 actionable "re-register" message instead of the generic invalid-
 credentials response. The disclaimer returned by
 `POST /api/v1/register` now matches the public privacy policy and
 the plugin first-run setup message — single source of truth across
 surfaces.
- **Daily Community-SaaS inactivity sweep** terminates tenants idle for
 more than 3 months and tenants past the 1-year hard cap, cascade-
 deleting their tenant-scoped data (audit logs, policies, workflows,
 plans, etc.) in a single transaction so a partial failure rolls the
 whole tick back. The cascade table list is reflected from
 `information_schema` at agent startup with a hard non-cascade
 allowlist for structural tables. Multi-instance correctness via
 Postgres advisory lock — only one agent task runs the sweep per
 tick. Opt-in per deploy via `COMMUNITY_SAAS_SWEEP_ENABLED=true`,
 with `COMMUNITY_SAAS_SWEEP_DRYRUN=true` available so operators can
 soak the predicate logic for 24h before flipping the real switch.
 Per-termination audit-log line plus Prometheus counters for
 inactivity terminations, hard-cap terminations, lock-skip events,
 cascade row counts, and tick failures.

#### Changed

- **OpenAPI specs now declare 24 fields the platform has been emitting
 on the wire but the spec hadn't documented.** `AuditLogEntry`
 (`metadata`, `model`, `policy_violations`), `DynamicPolicy` (7 CRUD
 fields), `PlanResponse` (4 plan-context fields),
 `ResumePlanResponse` (7 resume-context fields), plus 16
 lower-priority schemas covering audit query params, budget/usage
 fields, execution-snapshot HITL fields, workflow step audit context,
 and the multimodal payload field on `ClientRequest`. Closes the
 spec-side gap surfaced by the Python SDK's wire-shape contract gate.

#### Fixed

- **`/health` now reports the deployed platform semver.** Previously
 the `version` field returned `1.0.0` on every deployed stack because
 the CloudFormation templates wired `AXONFLOW_VERSION` to the agent
 image tag (`latest`, git SHA, etc.), which failed the semver regex
 in the agent's version resolver. A new dedicated `PlatformVersion`
 CFN parameter with a built-in semver `AllowedPattern` is now wired
 to `AXONFLOW_VERSION` independently of the image tag, and a new
 `VERSION` file at the repo root is the single source of truth read
 by both the build pipeline and the deploy script. A version-
 alignment validator runs on every push.
- **`MCPCheckInputResponse` now emits `decision_id` on the allow path**
 of `POST /api/v1/mcp/check-input` (it was already emitted on every
 deny path). Every governance decision was supposed to surface
 `decision_id` so callers can correlate the decision back to
 the audit log via `/explain/{id}` without a round-trip — the allow
 path silently dropped it. Same fix applied to
 `MCPCheckOutputResponse` (which gains a `decision_id` field) and to
 the MCP-tool variants so plugin-visible shape is consistent across
 HTTP and MCP-tool surfaces.
- **`try.getaxonflow.com` blocks SQL injection again.** Community SaaS
 deployments now pin `SQLI_ACTION=block` on the agent task,
 overriding the v6.2.0+ relaxed default profile that demoted SQLi
 enforcement to `warn`. Configurable per-deploy via the new
 `SqliAction` CFN parameter (`block` / `warn` / `log`, default
 `block`). Takes effect on the next community-saas deployment.
- **`try.getaxonflow.com` plan generation no longer 504s at 60 seconds.**
 The community-saas CFN template's `AlbIdleTimeoutSeconds` parameter
 (default 300) ships pre-set; the next deployment of the running
 stack picks up the 300s idle timeout so long MAP plan-generation
 requests complete without hitting the front-door gateway timeout.
- **`docs/api/agent-api.yaml` and `docs/api/orchestrator-api.yaml` now
 lint clean.** 21 broken `$ref` references to a non-existent `Error`
 schema in `agent-api.yaml` are repointed to the existing
 `ErrorResponse` (same shape both handlers return). Five additional
 broken refs in `orchestrator-api.yaml` are resolved by adding the
 missing `OrgIDQuery` parameter and three EU AI Act conformity
 schemas. Several malformed-example errors and `no-$ref-siblings`
 violations across the two specs are corrected.

#### Documentation

- **SDK telemetry contract: 7-day delivered-heartbeat.** All four SDKs
 follow the same contract: AxonFlow emits at most one anonymous
 heartbeat per environment every 7 days during SDK activity. The
 telemetry contract document is rewritten with the new cadence
 section, per-OS stamp-file specification, and a 9-case heartbeat
 conformance test matrix plus a 4-run cross-process E2E. Plugin
 parity (sibling 7-day-heartbeat at hook-fire time) noted at the
 bottom of the contract, including the deliberate stamp-filename
 split: SDKs use `{sdk}-telemetry-last-sent` while plugins keep the
 legacy `{codex,claude-code,cursor,openclaw}-plugin-telemetry-sent`
 so existing installs preserve their `instance_id` across the
 upgrade.
- **Telemetry opt-out is `AXONFLOW_TELEMETRY=off` everywhere.**
 `DO_NOT_TRACK` is no longer honored as an opt-out across all four
 SDKs and all four plugins. `DO_NOT_TRACK` is commonly inherited from
 host tools and developer environments — host CLIs like Codex and
 Claude Code inject it unconditionally — making it an unreliable
 expression of user intent. Documentation, ADRs, and the README
 callout are updated.
- **Examples and SDK reference docs updated for the v7 majors.**
 Install-command snippets, dependency declarations, getting-started
 guides, tutorials, gateway/proxy guides, compliance pages, MCP audit
 logging, execution tracking, and the configurable-agents reference
 now point at the new SDK majors. Historical "Since vX" references
 are intentionally left as-is — those document when a feature was
 added.

#### CI / Testing

- **Tier-gate contract CI** now runs every PR that touches the agent
 or orchestrator code paths against a fresh docker-compose stack in
 community, evaluation, and enterprise modes, and asserts that each
 guarded endpoint returns the documented status code per tier.
 Catches drift between the published tier matrix and actual handler
 enforcement before merge.
- **OpenAPI validation now covers all three specs.** Previously only
 `policy-api.yaml` was linted in CI; `agent-api.yaml` and
 `orchestrator-api.yaml` were silently exempt and accumulated
 structural defects (broken refs, duplicate schemas, malformed
 examples). The validator now loops over all three specs and runs
 per-spec breaking-change diffs against the base branch.

### Evaluation

- All Community changes apply.
- The plugin-compatibility check, the openapi corrections, and the
 Community-SaaS lifecycle additions all flow through Evaluation
 unchanged. No new Evaluation-tier endpoints, no Evaluation-only
 behaviour changes in this release.

### Enterprise

- All Community + Evaluation changes apply.
- No Enterprise-only behaviour changes in this release. The portal,
 customer-portal-ui, and the rest of the Enterprise tree pick up the
 Community-side fixes (correct `/health` semver, `decision_id` on
 allow, etc.) automatically.

### SDKs

- **Go SDK v7.0.0** — module path advances from `/v6` to `/v7`.
 `DO_NOT_TRACK` is no longer honored; use `AXONFLOW_TELEMETRY=off`.
 Anonymous heartbeat now follows the 7-day-per-environment cadence.
- **Python SDK v7.0.0** — `axonflow>=7.0.0`. `StaticPolicy` and
 `PolicyVersion` now serialize wire fields in snake_case to match
 the OpenAPI spec; camelCase keys still accepted on input via field
 validation aliases so existing consumers keep working — round-trip
 identity is no longer preserved for callers that built models from
 camelCase dicts. `DO_NOT_TRACK` removed; 7-day heartbeat cadence
 shipped.
- **TypeScript SDK v7.0.0** — `@axonflow/sdk@^7.0.0`. `DO_NOT_TRACK`
 removed; 7-day heartbeat cadence shipped.
- **Java SDK v7.0.0** — `<version>7.0.0</version>` on the
 `axonflow-sdk` dependency. `DO_NOT_TRACK` removed; 7-day heartbeat
 cadence shipped.

See each SDK's release notes for the per-language migration shape.

### Plugins

- **OpenClaw v2.0.0** — `npm install @axonflow/openclaw@^2.0.0`.
 `DO_NOT_TRACK` removed; `AXONFLOW_PLUGIN_VERSION_CHECK=off` to skip
 the new platform compatibility check.
- **Claude Code plugin v1.0.0** — graduates from the 0.x line to a
 stable 1.x. `DO_NOT_TRACK` removed.
- **Cursor plugin v1.0.0** — graduates from the 0.x line to a stable
 1.x. `DO_NOT_TRACK` removed.
- **Codex plugin v1.0.0** — graduates from the 0.x line to a stable
 1.x. `DO_NOT_TRACK` removed.

All four plugins query the platform's `/health` at startup, read
`plugin_compatibility.min_plugin_version[<canonical id>]`, and emit a
single upgrade hint to stderr when the runtime version is below the
floor. Below recommended-but-above-min logs an info-level note;
at-or-above recommended is silent. Older platforms that don't
advertise the field degrade silently. Skippable per-plugin via
`AXONFLOW_PLUGIN_VERSION_CHECK=off`.

## [7.4.5] - 2026-04-28 — Phase 1 quality-freeze fixes + MAP execution-tracking org isolation

PATCH: bug fixes only. The headline platform fix is a pair of org-identity propagation bugs in the MAP execution path that made `GET /api/v1/executions` return zero rows for newly-completed plans and let body-supplied identity override the authenticated org/tenant on policy evaluation. The rest is the close-out of the Phase 1 quality-freeze sweep against the bundled examples — every example now compiles, runs, and exits with a clear PASS/FAIL summary against a stock community-mode docker-compose stack.

No breaking changes. No new endpoints, SDK methods, or features.

### Community

#### Fixed

- **`GET /api/v1/executions` returned zero rows for newly-completed MAP plans.** Plans executed via `POST /api/request` with `request_type=execute-plan` were recorded in the execution-tracking store with an empty `org_id`, while the read-side filter (driven by the authenticated org from Basic auth) required a non-empty match — so every MAP plan execution produced a row that was invisible to subsequent list calls. The execution recorder now persists the same authenticated org used for filtering on read, and policy evaluation, plan storage, and replay tracking all read org and tenant from the same authoritative source on every request. A request can no longer be recorded under one org and policy-evaluated under another, even if a caller bypasses the agent and supplies mismatched values directly.
- **MAP examples updated to current SDK releases** — Go 5.8.0, TypeScript 6.1.0, Python 6.8.0, Java 6.1.0 — so `go run`, `npm start`, `python main.py`, and `mvn exec:java` work against the published SDKs on a fresh checkout.
- **`examples/cost-estimation/http/execution-cost-validation.sh`** now exits with a clear PASS/FAIL summary instead of aborting mid-run with exit code 5 when a response is malformed (e.g. on auth failure). The script was rewritten to use the generate-plan → execute-plan → fetch-cost flow that actually surfaces a non-zero plan cost in Community.
- **`examples/risk-tiered-approvals/go`** now compiles from a clean checkout. The directory was missing `go.mod` and `go.sum`, so `go run main.go` failed with `no required module provides package`. The example also referenced an SDK type that was renamed before release; corrected to the published name. Both Go and Python variants now pass end-to-end. Test 3 (HITL queue listing) skips on Community and Evaluation with an accurate message — the queue endpoint is Enterprise-only and was previously mis-labelled.
- **`examples/media-governance-policies/typescript`** Test 4b no longer fails with `tenant_id=undefined`. The TypeScript SDK exposes `MediaGovernanceConfig` fields in camelCase (`tenantId`); the example was asserting on the wire-shape snake_case field. Aligned the assertion and the log line.
- **`examples/audit-logging` (TypeScript and Java)** now match the Python variant's authentication setup so `auditToolCall` succeeds without `Missing authentication` errors.
- **`examples/llm-routing/go`** updated to the current routing API shape so the demo works against a stock stack.
- **`examples/mcp-connectors/cloud-storage`** rewritten to exercise a working S3-compatible flow against the MinIO instance bundled in the docker-compose stack.
- **`examples/.gitignore`** no longer excludes `go.sum`. Every Go example now ships with its lockfile committed so a clean clone runs without needing `go mod tidy`. Two stale `replace` directives in `examples/wcp-retry-idempotency/{community,evaluation}/go/go.mod` (pointing at sibling-checkout SDK paths) and a 0-byte orphan `examples/policies/go/go.mod` were also cleaned up.
- **`examples/policies/http/policies.sh`** Create Custom Policy now sends a valid request body — a single `pattern` regex with a recognized category — instead of an invalid array shape that the platform was rejecting with HTTP 400. The script previously printed "Status: Created" without checking the response, masking the failure.
- **`examples/gateway-policy-config/python`** no longer crashes with `TypeError: get_env() missing 1 required positional argument`.
- **`examples/workflow-control/go`** now compiles. `ApproveStep` and `RejectStep` were called with two arguments after the SDK signatures had added a third (approver_id).
- **`examples/hello-world/typescript`** is now a policy-only demo matching the other three SDKs. The Gateway Mode TypeScript example moved to `examples/integrations/gateway-mode/typescript/`.

#### Documentation

- **Python version prerequisite for examples.** `examples/README.md` and a new `examples/retry-semantics/python/README.md` now state that several Python examples require Python 3.10+ and the current `axonflow` PyPI release. The older pinned `axonflow==4.1.0` from earlier examples does not expose retry-policy or lifecycle fields used here and will fail on import or with a missing-attribute error. Users on systems where `python3` defaults to 3.9 (e.g. older macOS) should create a venv on a newer interpreter before running these examples.

## [7.4.4] - 2026-04-25 — `CreateOverrideResponse` schema split

PATCH: documentation-grade correction — no platform behaviour change. Splits the `POST /api/v1/policies/{id}/overrides` create-response shape from the at-rest `PolicyOverride` entity, matching what the platform server has been emitting all along and the precedent established by `CreateWorkflowResponse` (orchestrator-api.yaml). Code-generated clients written against the prior spec would have read `undefined` for the create-time TTL clamping fields (`ttl_seconds`, `requested_ttl`, `clamped`, `clamped_reason`) and looked for at-rest fields (`action_override`, `enabled_override`, `tool_signature`) that the create response doesn't carry.

### Community

#### Fixed

- **`CreateOverrideResponse` schema added** to `docs/api/agent-api.yaml`. The `createStaticPolicyOverride: 201` response now references this dedicated schema instead of the at-rest `PolicyOverride`. Carries `id`, `policy_id`, `policy_type`, `expires_at`, `ttl_seconds`, optional `requested_ttl` / `clamped` / `clamped_reason` (populated when server-side TTL clamping kicked in), and `created_at`. The at-rest `PolicyOverride` schema retains its role on `GET /api/v1/policy-overrides` / `GET /api/v1/policy-overrides/{id}`.

 AxonFlow's hand-written OpenClaw plugin already implements `CreateOverrideResult` matching the actual server shape — this fix aligns the spec with the plugin's reality and unblocks code-generated clients.

## [7.4.3] - 2026-04-25 — Plugin Batch 1 spec corrections

PATCH: documentation-grade corrections — no platform behaviour change. Companion to the 4 plugin wire-shape contract gates landing alongside (parity with the four SDK gates). Auto-resolves the bulk of those plugins' initial baseline drift entries.

### Community

#### Fixed

- **OpenAPI spec corrections — Plugin Batch 1 explainability fields.** Two MCP-response schemas have been stale relative to what the agent has emitted since Plugin Batch 1 shipped. The fix unblocks code-generated clients and auto-resolves baseline drift entries on every AxonFlow plugin's wire-shape contract gate.
 - **`MCPCheckInputResponse`** gains the five Plugin Batch 1 fields the agent has emitted since v7.1.0 (`decision_id`, `risk_level`, `policy_matches`, `override_available`, `override_existing_id`).
 - **`MCPCheckOutputResponse`** gains `redacted_message` (text-redaction counterpart to `redacted_data`), `decision_id`, and `policy_matches`.
 - **`ExplainPolicy`**, **`ExplainRule`**, **`DecisionExplanation`** schemas added — these are the explainability shapes returned by the `explain_decision` MCP tool. Hand-written SDKs and plugins are already aligned with what the agent emits; this just documents the wire contract.

## [7.4.2] - 2026-04-25 — OpenAPI spec corrections

PATCH: documentation-grade corrections — no platform behavior change.
Two OpenAPI schemas were stale relative to what the server has been
emitting. Code-generated clients written against the prior spec would
have read `undefined` for the affected fields. AxonFlow's hand-written
SDKs (TS, Python, Go, Java) are correct against the server and gain
no functional change from this release; the fix lives entirely in the
spec artefacts.

### Community

#### Fixed

- **`AISystemRegistry.materiality` → `materiality_classification`**
 in `docs/api/masfeat-api.yaml`. Server has emitted
 `materiality_classification` since the 3-dimensional risk rating
 refactor for MAS AI Risk Management Guidelines 2025.
- **`DynamicPolicyInfo`** in `docs/api/agent-api.yaml` rewritten from
 8 aspirational fields to the 4 actual server fields
 (`policies_evaluated`, `matched_policies`, `orchestrator_reachable`,
 `processing_time_ms`).

## [7.4.1] - 2026-04-23 — Portal HITL + audit trail fixes

PATCH: portal-visible bugs fixed around human approval visibility —
approver identity on the execution timeline, Compliance Summary card
aggregates, HITL audit trail row emission, workflow-level aborted
status propagation, stale-snapshot reconciliation for pre-patch
workflows, and a sidebar badge refresh on approve/reject. Platform-only
release — no SDK or plugin changes. All fixes hit the same HITL audit
and approval visibility story so operators can answer "who approved
what, when, and did the compliance summary count it?" without joining
three tables.

### Community

#### Fixed

- **Unified execution step now distinguishes approver from rejector.**
 The unified execution API (`/api/v1/unified/executions/{id}`)
 populated `approved_by` with the rejector's email on rejected steps
 because the serializer projected `workflow_steps.approved_by`
 verbatim regardless of terminal state. The step serializer now
 splits into `approved_by` / `approved_at` on the approval path and
 `rejected_by` / `rejected_at` on the rejection path, mirroring the
 split already done by `workflow_control.ProjectStepGateToHTTP` on
 the WCP HTTP response. `execution.StepStatus` gains two new fields
 (`RejectedBy`, `RejectedAt`).
- **`/api/v1/audit/summary` returns six card-view aggregates.** The
 response previously emitted `total_events` / `by_severity` /
 `by_action` / `top_policies` / `compliance_score` — the handler
 now additionally computes and returns `total_requests`,
 `allowed_requests`, `blocked_requests`, `modified_requests`,
 `block_rate_percent`, `avg_latency_ms`. Legacy fields retained for
 back-compat. Block rate is derived from the allowed/blocked/modified
 counts; average latency is a separate query over `response_time_ms`
 excluding rows where latency wasn't measured (HITL decisions,
 workflow-lifecycle events).
- **Compliance Summary arithmetic always closes.** The summary
 handler previously only counted `allowed` / `blocked` / `redacted`
 decisions explicitly; `pending_approval` (from `workflow_step_gate`
 rows where HITL fires require_approval) and `error` decisions were
 dropped between the buckets, so `total_requests` could exceed
 `allowed_requests + blocked_requests + modified_requests` by the
 number of orphan rows. Now every non-blocked, non-redacted decision
 rolls into Allowed — Total = Allowed + Blocked + Modified is
 always true. `pending_approval` counts as allowed because the
 policy didn't block; the subsequent human decision writes its own
 `workflow_step_approved` / `workflow_step_rejected` row.
- **Historical workflows decided before v7.4.1 deployed now render
 their terminal approval state.** The unified-execution cache was
 written at `/gate` time (approval_status=pending) and pre-v7.4.1
 approve/reject paths did not re-sync it — so any workflow decided
 before the fix deployed would forever show "Approval: pending" on
 the execution API. `GetWorkflowStatus` now reconciles cached step
 snapshots against current `workflow_steps` state on every read via
 a new `reconcileStepApprovals` helper. Steps present in the cache
 but absent from the fresh rows are left untouched so partial WCP
 state can't clobber the cache; WCP fetch failure falls back to the
 cached snapshot.

### Evaluation

#### Fixed

- **WCP step approve + reject now emit rows in `audit_logs`.** The
 WCP step-approve/reject endpoints
 (`/api/v1/workflows/{id}/steps/{step_id}/approve|reject`, Evaluation+)
 previously updated `workflow_steps.approval_status` and fired a
 webhook but never wrote to `audit_logs`, so any audit pipeline that
 reads `audit_logs` had no trace of approvals or rejections — rejected
 steps never appeared as "Blocked" rows, compliance summaries ignored
 the events, and operator dashboards showed "N/A" under user. Both
 paths now write an `audit_logs` row via the existing
 `WorkflowAuditEntry` pipeline with `request_type="workflow_step_approved"`
 / `"workflow_step_rejected"`, `policy_decision="allowed"` on approve
 / `"blocked"` on reject, and the reviewer's `X-User-Email` populated
 on `user_email`. `WorkflowAuditEntry` gains `UserEmail` / `UserRole`
 so reviewer identity carries through the audit adapter end-to-end.
- **Reject propagates the aborted status to the unified execution
 tracker.** `RejectStep` flipped `workflow_steps.approval_status`
 and called `repo.Abort(.)` on the workflow, but never notified
 `executionTracker.OnWorkflowAborted(.)`. `GetWorkflowStatus`
 prefers the cached unified execution when one exists, so
 `/api/v1/unified/executions/{id}` kept reporting the overall
 execution as running/pending even though the rejection had already
 aborted the workflow. Now calls `OnWorkflowAborted` after the abort
 succeeds — only when the abort actually landed, so we don't lie
 about workflow state on an abort failure.

### Enterprise

#### Fixed

- **HITL queue approve + reject now emit rows in `audit_logs`.** The
 Enterprise HITL queue endpoints
 (`/api/v1/hitl/queue/{id}/approve|reject`) previously wrote only to
 `hitl_approval_history` (the immutable compliance audit trail), so
 the audit-logs-based portal audit page had no trace of queue-driven
 approvals/rejections — the USER / TENANT column showed "N/A" and
 rejections never appeared as "Blocked" rows. Both paths now write
 an `audit_logs` row via a new `Repository.WriteHITLAuditEvent`
 helper with `request_type="workflow_step_gate"`,
 `policy_decision="allowed"` on approve / `"blocked"` on reject,
 the reviewer's email and role populated, and `workflow_id` /
 `step_id` / `request_id` / `policy_name` in `policy_details`. Write
 is best-effort — a DB failure does not fail the mutation because
 `hitl_approval_history` remains the authoritative record.
- **Portal execution timeline renders rejector identity correctly.**
 The portal execution page already read `approved_by` and
 `rejected_by` as separate fields, but the Community-side serializer
 only populated `approved_by` — so a rejected step appeared as
 "approved by \<rejector\>". Paired with the Community-side split
 above, the timeline now renders "Approval: rejected by \<email\>
 on \<date\>" when `approval_status=rejected` and the approved
 variant when approved, suppressing the other field in each case.
 `ExecutionStep` on the portal API client gains `rejected_by` /
 `rejected_at`.
- **Sidebar approvals badge refreshes immediately after approve or
 reject in the same tab.** The Navigation component polls
 `getPendingApprovals` every 30 s. When a reviewer approved or
 rejected from the side panel, the approvals list removed the row
 optimistically but the `1` badge next to "Approvals" in the sidebar
 lingered until the next poll — visually making the queue look
 unreclaimed. The approvals page now dispatches an
 `approvals:updated` CustomEvent on success; Navigation listens and
 re-fetches immediately. Event listener cleaned up on unmount
 alongside the polling interval. Cross-tab approvals (second browser
 window, SDK, or CLI) still fall back to the 30 s poll — same-tab
 only is the scope of this fix.

---

## [7.4.0] - 2026-04-22 — HITL Response Parity

MINOR: both HITL planes now return the same rich response shape, MAP's
plan-scoped approve/reject endpoints are now available at **Evaluation** tier
(previously Enterprise-only), and MAP gains a plane-scoped pending-approvals
listing symmetric with the existing WCP endpoint. `decision` resolves to
`"allow"` / `"block"` once the mutation lands, `retry_context` mirrors the
gate response retry state, approver metadata comes from the same persisted
row, `approval_id` surfaces the HITL queue entry UUID, and `policies_matched`
reconstructs the governance trail. Contract tests in CI lock the two planes'
response shapes together so future additions surface on both endpoints by
default — both for approve/reject and for the plane-scoped pending listings.

No breaking changes. Purely additive — the legacy `workflow_id` / `step_id` /
`status` / `approval_status` / `approved_by` / `message` fields existing
callers rely on are unchanged.

### Community

#### Added

- **Shared HITL response projection helper** in the community codebase —
 `workflow_control.ProjectStepGateToHTTP` and `DeriveHITLApprovalID`. Both
 planes' handlers use it, so the wire shape stays consistent and the
 deterministic HITL queue UUID reappears on every response where the
 backing workflow_steps row exists.
- **Plan-to-workflow lookup** — `GetWorkflowByPlanID` service method +
 PostgreSQL repository implementation (index on `metadata->>'plan_id'`).
 Enables plan-scoped HITL endpoints to project from the same
 `workflow_steps` row that /gate and /complete use.

#### Deprecated

- `DO_NOT_TRACK=1` as an AxonFlow SDK telemetry opt-out — scheduled for
 removal after 2026-05-05 in the next major release. Use
 `AXONFLOW_TELEMETRY=off` instead. All 4 SDKs emit a one-line migration
 warning when `DO_NOT_TRACK=1` is the active control and
 `AXONFLOW_TELEMETRY=off` is not also set. See the SDK CHANGELOGs for
 per-language notes.

### Evaluation

#### Added

- **Rich WCP approve/reject responses.** `POST /api/v1/workflows/{id}/steps/{step_id}/approve`
 and `./reject` now return `decision`, `reason`, `retry_context`,
 `approval_id`, `approved_by` / `approved_at` (or `rejected_by` /
 `rejected_at`), `policies_matched`, `status`, and `message`. Documented
 in OpenAPI as `ApprovalResponse`; mirrors the step-gate response field set.
- **Rich MAP approve/reject responses** at the `/api/v1/plans/{id}/steps/{step_id}/approve|reject`
 endpoints. Same shape as WCP plus a `plan_id` field. Two underlying flows —
 confirm/step mode (WCP-backed) and legacy policy-driven pause/resume —
 now surface a uniform shape so clients don't branch on which mode the
 plan ran in.
- **Plane-scoped pending-approvals listing** — new
 `GET /api/v1/plans/approvals/pending` endpoint (Evaluation+), the MAP
 counterpart of the existing `GET /api/v1/workflows/approvals/pending`.
 Returns `{pending_approvals, count}` with every entry carrying `plan_id`
 (populated from `workflows.metadata->>'plan_id'`). Optional `?plan_id=`
 query param scopes the listing to a single plan so reviewer tools can
 render per-plan context without filtering client-side. Tier-gated on
 `IsHITLApprovalEnabled()` — same gate as the plane-scoped approve/reject.

#### Changed

- **MAP plan-scoped HITL tier gate lowered to Evaluation+** (was Enterprise-only
 pre-v7.4.0). Tier check now matches WCP: community + Evaluation license →
 accepted; community + no license → 403; enterprise mode → accepted. Error
 message updated from "requires Enterprise license" to "requires Evaluation
 or Enterprise license."
- **Cross-plane contract test** in CI asserts the WCP and MAP response field
 sets stay aligned modulo the intentional `plan_id` asymmetry. Guards
 against silent future drift when either plane grows a new field. A sibling
 `TestPendingApprovalsPlaneParity` does the same for the plane-scoped
 pending-approvals listings — the intentional `plan_id` asymmetry is
 enforced: populated on every MAP entry, never on WCP entries.

### SDKs

- **Go SDK v5.6.0** — `ApproveStepResponse` / `RejectStepResponse` gain
 `Decision`, `Reason`, `ApprovalStatus`, `ApprovalID`, `ApprovedBy` /
 `ApprovedAt` / `RejectedBy` / `RejectedAt`, `PoliciesMatched`,
 `RetryContext`, `Message`, `PlanID`. New `GetPendingPlanApprovals` method
 covers the MAP-plane listing. `PendingApproval` extended with `PlanID`,
 `StepIndex`, `Decision`, `DecisionReason`, `PoliciesMatched`, `StepInput`,
 `ApprovalStatus`. Also fixes three pre-existing URL bugs on
 `ApproveStep` / `RejectStep` / `GetPendingApprovals` (they were hitting
 non-existent `/api/v1/workflow-control/` paths) and renames the response
 wire shape to match the server (`PendingApprovals` / `Count`).
- **TypeScript SDK v5.6.0** — same rich fields on `ApproveStepResponse` /
 `RejectStepResponse` interfaces, new `getPendingPlanApprovals`, extended
 `PendingApproval` interface, and the same WCP URL / response-shape fixes.
- **Python SDK v6.6.0** — rich optional fields on the pydantic
 `ApproveStepResponse` / `RejectStepResponse` models, new
 `get_pending_plan_approvals` method (sync wrapper included), extended
 `PendingApproval` model, and the same WCP URL / response-shape fixes.
- **Java SDK v5.7.0** — rich fields on `WorkflowTypes.ApproveStepResponse`
 and `.RejectStepResponse`, plus back-compat 3-arg constructors so existing
 test fixtures keep compiling. New `getPendingPlanApprovals` + async
 variant. Extended `PendingApproval` class with back-compat 6-arg
 constructor. Same WCP URL / response-getter fixes.

---

## [7.3.0] - 2026-04-21 — Retry Semantics & Idempotency

MINOR: first-class retry and idempotency surfaces on the Workflow Control
Plane. The `cached: bool` signal every gate response has been returning is
now a deprecated alias — responses carry a `retry_context` block that
answers "how many gate calls?", "did any prior attempt complete?", and
"what was the prior decision?" unambiguously. A new caller-supplied
`idempotency_key` on gate + complete anchors a workflow step to a
business-level identity (payment intent, invoice, claim reference), with
strict match validation between the two endpoints.

No breaking changes. Purely additive.

### Community

#### Added

- **`retry_context` on every `StepGateResponse`** — always present, including
 on the first gate call (where counters are 1/0 and
 `prior_completion_status` is `"none"`). Fields: `gate_count`,
 `completion_count`, `prior_completion_status` (enum `none` / `completed` /
 `gated_not_completed`), `prior_output_available`, `prior_output`,
 `prior_completion_at`, `first_attempt_at`, `last_attempt_at`,
 `last_decision`, `idempotency_key`. Counter bookkeeping is atomic inside
 the repository UPSERT; a separate cached-hit update keeps counters
 accurate across idempotent retries without re-evaluating policy.
- **`?include_prior_output=true` query param on `/gate`** — opt-in inclusion
 of the prior `/complete` payload in `retry_context.prior_output`. Default
 is `false` (null) because output may be large and/or contain sensitive
 data. When the opt-in is set AND a prior completion exists, the full
 output is returned so agents can safely short-circuit re-execution.
- **Caller-supplied `idempotency_key` on `/gate` and `/complete`** —
 optional opaque string up to 255 chars. Recorded on the first gate call
 that sets it; immutable for the step's lifetime. Surfaced on every
 subsequent `retry_context.idempotency_key`. Audit log records the key
 on every `step_gate` and `step_completed` event.
- **`HTTP 409 IDEMPOTENCY_KEY_MISMATCH`** returned when `/complete` (or a
 subsequent `/gate`) passes a different key than the one recorded on the
 first gate, or when one side supplies a key and the other omits it.
 Response envelope includes `expected_idempotency_key` and
 `received_idempotency_key` so SDKs can build typed errors.
- **`cached` and `decision_source` fields remain on every response** so
 existing SDK versions continue working unchanged. Both are marked
 deprecated in the wire docs; `retry_context.gate_count > 1` replaces
 `cached: true` and `retry_context.prior_completion_status` replaces the
 string-typed `decision_source`.

#### Changed

- **`MarkStepCompleted` HTTP handler** now reads tenant identity from
 `X-Tenant-ID` consistently with `StepGate` rather than from
 `X-Client-ID`. A real multi-tenant caller setting the tenant header now
 works on both endpoints; previously the complete path rejected the
 request as "workflow not found" because the isolation check compared
 against the wrong attribute. No behavior change for callers using
 empty headers.

### Evaluation

#### Added

- **Retry-aware dynamic policy conditions** — the policy engine now
 resolves seven new `step.*` fields: `step.gate_count`,
 `step.completion_count`, `step.prior_completion_status` (enum `none` /
 `completed` / `gated_not_completed`), `step.prior_output_available`,
 `step.last_decision`, `step.first_attempt_age_seconds`, and
 `step.idempotency_key`. Policy authors can write rules like
 "retry on un-completed payment requires approval", "more than three
 attempts = block", or "rapid retry within 30 seconds escalates severity"
 without custom code. These fields are added to `ValidPolicyFields` so
 the create/update policy APIs accept them.
- **Tier-gated create:** attempting to author a dynamic policy with any
 `step.*` condition on a Community license is rejected at create time
 with `FEATURE_REQUIRES_EVALUATION_LICENSE`. Evaluation and Enterprise
 tiers accept. Enforcement sits in `PolicyService.validateTierForCreate`
 before the tenant policy-count check, so the rejection fires cleanly
 without a DB roundtrip.
- **UX note for policy authors:** retry-aware policies only fire when
 callers pass `retry_policy: "reevaluate"` on subsequent `/gate` calls.
 Default-idempotent retries hit the cache and bypass the policy engine,
 consistent with the existing cache semantics. Documented in the
 bundled Evaluation-tier example.

### Enterprise

No Enterprise-exclusive additions in this release. Cross-workflow
idempotency lookup, windowed operators like `idempotency_key_seen_within`,
retry-pattern correlation across workflows, and compliance-grade
audit/reporting for duplicate prevention are on the roadmap for a
later release.

---

## [7.2.1] - 2026-04-21

PATCH: surface the HITL approval metadata that was already being captured
internally but dropped on the way out of the API. No schema changes, no
breaking changes — callers that previously handled `null` simply start
seeing real values.

### Community

#### Fixed

- **`/api/v1/workflows/{id}` now surfaces `approved_by` and `approved_at` on
 each step.** The `StepInfo` DTO used by the workflow-detail response was
 missing both fields, so callers polling for approval completion saw
 `approval_status: "approved"` but no approver identity or timestamp.
 Both fields were already captured by `ApproveStep` and persisted on the
 `WorkflowStep` row — the DTO just wasn't copying them over. Portal and
 SDK consumers now get the full provenance without a second round-trip
 to the audit log.
- **`StepGateResponse.approval_id` populated on `require_approval`
 decisions.** The HITL adapter was creating the approval queue entry and
 setting `StepGateEvaluation.ApprovalID`, but the API response struct
 didn't carry the field. SDK clients that want to correlate a paused
 step with its HITL queue row (for Slack/PagerDuty routing, direct
 portal deep-links, or programmatic approval) now get `approval_id` on
 the same response that reports the `require_approval` decision.

### Enterprise

#### Fixed

- **Customer Portal `/approvals` page no longer crashes on expand.** The
 `PendingApproval.policies_matched` TypeScript type declared the field
 as `string[]`, but the `/api/v1/workflows/approvals/pending` endpoint
 returns an array of `PolicyMatch` objects (`{policy_id, policy_name,
 action, risk_level, allow_override, policy_description}`). React
 tried to render the object directly and threw error #31 ("Objects
 are not valid as a React child"), dumping the approver into the
 ErrorBoundary fallback the moment they clicked a row to expand the
 detail panel. The approvals page now accepts either shape, extracts
 `policy_name` when given an object, and surfaces `policy_description`
 as a tooltip on the matched-policy chip.

---

## [7.2.0] - 2026-04-20 — The Bug Bash Bonanza 🪲🔨

A focused hardening release: a full sweep across the Customer Portal
HTTP surface, tenant-scope fail-closed enforcement on every
read-and-action endpoint, three new public platform knobs for the
MAP plan-execution budget, dedicated HTTP examples for every route
the Portal calls, a login-endpoint fix that closes an
org-enumeration leak via both response body and timing, and fixes
to make MAP plans run the full 5 minutes the server is happy to
give them. MINOR per semver — additive surface only; every 7.1.x
caller keeps working without changes.

### Added

#### Community

- **`AXONFLOW_MAP_MAX_TIMEOUT_SECONDS` orchestrator env.** Caps the
 MAP plan-execution budget without a binary rebuild. Clamped to
 60..1800 seconds; default 300. The effective value is logged at
 startup when non-default. If you front the orchestrator with a
 reverse proxy or load balancer, set its idle / read timeout to
 at least the orchestrator cap — otherwise long plans will be
 cut off at the proxy before the orchestrator finishes.

#### Enterprise

- **`AlbIdleTimeoutSeconds` CloudFormation parameter on the
 AWS Marketplace template.** Mirror of the Community knob.
- **`middleware.MaxBodyBytesMiddleware` exported on the Customer
 Portal.** Caps every POST/PUT/PATCH request body at 1 MiB by
 default; `MaxBodyBytesMiddlewareWithLimit(n int64)` returns a
 variant for routes that legitimately need a larger ceiling (SAML
 metadata, future file uploads). GET/HEAD are not wrapped.
- **Per-feature HTTP examples for every route the Portal UI
 calls.** Each example is runnable against a local Docker Compose
 stack and covers one topic end-to-end:
 - Full RBI AI-system lifecycle: register → validate → incident
 → kill-switch → board report → audit export.
 - SEBI dashboard, retention, readiness, and audit export.
 - EU AI Act conformity, accuracy/bias, and async export jobs.
 - Compliance evidence bundle (summary + stream-download).
 - Decision explainability with the cross-tenant 404 guard
 asserted.
 - License, deployment, nodes, and session metadata.
 - Policy bundle export/import with `overwrite_mode` semantics.
 - Full `/api/v1/auth/*` walkthrough: login, session, logout,
 SSO availability, forgot-password, reset-password,
 change-password — including the auth-enum identical-body
 assertions.
 A curl-based smoke runner covers every Portal API route (44
 total) without needing a browser, pairing with the Playwright
 health spec so CI and demo-freeze runs have a Playwright-free
 verification path. Every script passes `shellcheck` and runs
 green against local compose.
- **Compliance → Evidence Export Download button.** The Compliance
 page showed per-type record counts (audit logs, workflow steps,
 HITL approvals) but had no way to actually download the bundle.
 Added a Download Evidence button that streams the JSON bundle as
 a blob with a 30-day default window (the backend caps by tier)
 and saves as `axonflow-evidence-<start>-to-<end>.json`. Disabled
 with a tooltip explanation when counts are zero. Surfaces any
 backend error (tier / license / quota) as an inline alert
 instead of silently doing nothing.

### Fixed

#### Community

- **Agent now proxies `/api/v1/euaiact/*` to the orchestrator.**
 The single-entry-point mux listed `/rbi`, `/sebi`, and
 `/masfeat` alongside the rest of the compliance family but
 omitted `/euaiact`, so every EU AI Act call that landed on the
 front-door ALB returned `404 page not found` and the Portal's
 Compliance page reported the module as "not enabled for this
 tenant" even though peer modules rendered fine. Added the prefix
 to both the router and the proxy-allow-list.
- **Canonical `/api/v1/policy-overrides` alias on the agent.** The
 Portal's overrides handler proxies to this path, matching the
 `policy-categories` / `static-policies` / `dynamic-policies`
 naming pattern; the agent previously only exposed the tenant
 override list under `/api/v1/static-policies/overrides`.
 Callers using the canonical path hit 404 and the Portal's
 Policies → Overrides tab rendered empty. Same handler, new
 path, auth unchanged.
- **Agent `/health` includes `tier`.** The validated license tier
 (`Community` / `Evaluation` / `Professional` / `Enterprise` /
 `starting`) is now surfaced on the health response. Operators
 querying `curl /health | jq.tier` used to get `"unknown"`
 because the field was not present.
- **Orchestrator MAP plan-execution budget now caps at 300s by
 default.** MAP plans chain multiple LLM calls (~15s each); a
 typical 5-step plan routinely ran past the old 60s server-side
 default and truncated mid-stream even though the orchestrator
 was still working. The cap is now 300s out of the box and
 tunable via `AXONFLOW_MAP_MAX_TIMEOUT_SECONDS`. SDK note: the
 TypeScript SDK's default `mapTimeout` is 120s; clients relying
 on the default will cut off at 120s before the server cap
 takes effect. Pass `mapTimeout: 300000` on the SDK client
 config to match.
- **Orchestrator policy type allowlist accepts `context_aware`.**
 Three seeded system policies (Tenant Isolation, Debug Mode
 Restriction, Sensitive Data Control) ship with
 `policy_type=context_aware`; any update through
 `PUT /api/v1/policies/{id}` returned 400 because that type was
 missing from the allowlist.
- **`POST /api/v1/policies/{id}/overrides` accepts
 `require_approval` (HITL).** The override validator's allow-list
 was hand-written as `{block, redact, warn, log}`, silently
 dropping the HITL action even though the rest of the stack
 accepted it end-to-end. Standardised on a single canonical list
 of valid actions:
 - Policy authoring — `alert`, `block`, `log`, `modify_risk`,
 `redact`, `require_approval`, `route`, `warn`.
 - Override endpoint (terminal-action subset) — `block`,
 `require_approval`, `redact`, `warn`, `log`. Authoring-only
 actions are deliberately excluded — they have no
 terminal-action meaning and the agent's override repository
 would reject them anyway.
- **Test / Edit / Delete / Versions of legacy-named policies no
 longer 400.** The policy-ID validator only accepted UUIDs and
 the `sys_*` prefix, so seeded policies like
 `sensitive_data_control` and `tenant_isolation` failed every
 per-policy action with "Invalid policy ID format". Allowlist now
 also accepts the legacy snake-case form.
- **`GET /api/v1/policies` honours the `tier` and `category` query
 params.** The orchestrator's list handler dropped both at the
 handler boundary even though the repo supported them. Without
 this every Tier / Category dropdown in the Portal's
 `/policies` page returned the full unfiltered list.
- **Legacy V1 HMAC license format purged from active code.** The
 V2 Ed25519 format has been the only accepted key for months;
 stale HMAC references would have produced confusing failures
 in a clean shell. The rejection-path code that returns `"V1
 license format no longer supported"` is kept so an old key
 ever surfacing gets a clear error, not silent acceptance.

#### Enterprise

- **RBI FREE-AI: registering an AI system no longer 500s.** The
 repository's INSERT listed `board_approval_required`, but that
 column is a stored-generated column computed from
 `risk_category`. PostgreSQL rejected every write with
 `cannot insert a non-DEFAULT value into column
 board_approval_required`, so the Portal's RBI compliance page
 could never progress past step 1. Removed the column from the
 INSERT and UPDATE statements; the Go struct field is still
 populated at read time.
- **RBI FREE-AI: generating a board report no longer 500s.** The
 service layer set `generation_method = "automated"` but the
 database check constraint only accepts `'automatic'` or
 `'manual'`. Fixed the literal.
- **Marketplace CloudFormation: Agent security group can reach the
 Customer Portal.** Per the single-entry-point architecture,
 every public request funnels through the Agent, which then
 proxies `/api/v1/auth/*`, `/api/v1/portal/*`,
 `/api/v1/code-governance/*`, and `/api/v1/git-providers/*` to
 the Customer Portal over Cloud Map. The security group allowed
 ALB → Portal and Portal → Agent but nothing allowed Agent →
 Portal, so every auth call hitting the raw stack domain timed
 out after 30 seconds and fell back to `503 Backend service
 unavailable`. The vanity-domain host-header rule routed
 directly to the UI and masked the issue during demo prep; only
 requests on the raw stack domain surfaced it. Applies on
 `update-stack` without recycling ECS tasks.
- **Usage & Billing no longer returns zeros for every tenant.**
 The daily rollup was defined but never invoked — no scheduler,
 no goroutine, no on-demand call — so the rollup table stayed
 empty forever and the Portal's summary and time-series queries
 returned zeros even when the underlying events had rows. The
 aggregator is now idempotent (re-running an overlapping window
 recomputes the bucket rather than adding to it) and is called
 on-demand from the Usage handlers before they query the
 rollup — self-healing, no scheduler required. A pre-existing
 latent bug that surfaced once rollups populated
 (`COALESCE(AVG())` returns numeric, the scan target was int)
 is fixed in the same change.
- **`GET /api/v1/export/usage` no longer 500s.** The handler
 queried columns that didn't exist (`policy_id`, `latency_ms`,
 `success` — the real columns are `policy_decision`,
 `response_time_ms`, and a derived success flag), constructed
 `INTERVAL '$2 days'` which is not valid PostgreSQL
 parameterization (the `$2` inside a string literal is treated
 as literal characters, not a placeholder), and ignored the
 `start` / `end` query params the UI sends (only honouring a
 legacy `days=` param). Rewritten against the per-request
 metering table with correct columns, proper date-range handling
 for RFC3339 timestamps or `YYYY-MM-DD` dates, and surfaced DB
 errors in the server log instead of swallowing them behind the
 generic `"Database error"` response.
- **`GET /api/v1/license/status` no longer 500s for orgs without
 an `expires_at`.** The handler scanned the column into a
 non-nullable type; NULL expiry blew up inside `Scan`. Switched
 to a nullable target and treats NULL as ACTIVE.
- **`GET /api/v1/admin/organizations/{id}` no longer 500s.** The
 join against the SSO configuration table used the wrong join
 column; every org detail page 500'd with `pq: column
 s.org_id does not exist`.
- **Admin org list queries fixed against the heartbeat schema.**
 Both the list and detail endpoints joined `agent_heartbeats` on
 column names that don't exist (`organization_id`,
 `last_heartbeat_at`); the real columns are `org_id` and
 `last_heartbeat`. Both endpoints returned 500 with
 `pq: column "organization_id" does not exist`.
- **Customer Portal Docker image builds with the Enterprise Go
 tag.** The Portal Dockerfile previously hard-coded a Community
 build, so `license.GenerateLicenseKey` always returned the
 Community stub and admin onboarding 500'd on every call,
 leaving the orgs table empty and the SaaS deployment with no
 orgs to log in as.
- **Dashboard "Workflows Run" counts MAP plans too.** The
 dashboard summary queried the WCP-only execution endpoint, so
 MAP-only tenants saw `Workflows Run: 0` even after running
 plans. Now queries the cross-type unified executions endpoint
 with a fallback to the legacy shape for older server builds.
- **Dashboard no longer renders "Welcome," with an empty name.**
 The page mounted before `AuthContext.checkSession()` resolved,
 so the heading printed "Welcome," and the License Status card
 printed an empty Organization ID. The dashboard now waits on
 the session-loading gate.
- **Sidebar pending-approvals badge no longer fires a console
 401 on first paint.** The poll fired from a `useEffect` on
 mount without a user guard; on a hard refresh the first poll
 raced the session check and hit the catch-all orchestrator
 proxy without an authenticated session. The poll now waits
 for the user to be non-null and re-runs when the user
 changes.
- **`setup-vanity-domain` workflow overwrites stale CFN-managed
 ALB private-DNS aliases.** When a stack is rebuilt the old ALB
 DNS goes away; the workflow used to refuse to touch the
 existing record, leaving the Portal UI's API backend URL
 resolving to a deleted ALB inside the VPC — surfaced as 503
 "Backend service unavailable" on the login page. The workflow
 now upserts when the existing target matches the CFN naming
 pattern, and continues to skip operator-managed records.
- **Policy editor accepts `context_aware` and exposes
 `require_approval`.** Mirrors the orchestrator allowlist change
 above; users can now author HITL policies end-to-end without
 the request-level 400 that previously dropped the action at
 the Portal boundary.
- **Policy modal interactions no longer swallowed by the
 backdrop.** A CSS stacking-context bug made Save Changes,
 Cancel, and every form input unclickable; the Edit-policy
 flow looked broken. Promoted the dialog content to a higher
 z-index.
- **Modal form inputs readable in OS dark mode.** A leftover
 `prefers-color-scheme: dark` block from the create-next-app
 template repointed form text to near-white over a hardcoded
 white modal, so field values looked empty. The block is
 removed and native controls (checkboxes, scrollbars) now
 follow the light color scheme.
- **`/export` page no longer logs a React hydration error.** The
 date-range hint rendered `new Date().toLocaleDateString()`
 directly in JSX, producing different output on the SSR pass
 vs the client. Deferred the dates behind a `mounted` flag.
- **`POST /api/v1/admin/onboard-customer` accepts an optional
 `license_key`.** Lets operators register an org against an
 already-minted license (Lambda bootstrap, key-rotation
 scripts, existing SDK customers) without forcing the Portal
 to re-key. When set, in-process generation is skipped and
 the existing Secrets Manager entry is left untouched.
- **Marketplace CloudFormation: orchestrator connector secrets
 resolve under the per-stack environment name.** Fourteen
 connector secret paths used the wrong path component; on any
 non-default stack every connector came up with empty
 credentials. The `TaskExecutionRole` IAM grant now matches
 the per-stack path as well, with an `AllowedPattern` on
 `EnvironmentName` so typos fail at `CreateChangeSet` time
 rather than at runtime.

### Security

#### Community

- **Internal-service auth no longer accepts a static fallback
 token in non-Community deployments.** When the
 internal-service secret was unset, the agent fell through to
 a literal-string compare against a constant. Any caller
 knowing that constant could supply internal-service headers
 and impersonate the orchestrator, injecting arbitrary
 `X-Tenant-ID` / `X-Org-ID` for cross-tenant access. The
 fallback path is now gated to Community / Community-SaaS
 modes only; outside those a one-time security warning is
 logged at startup. HMAC and legacy plain-secret paths are
 unchanged.
- **Orchestrator audit handler fails closed when proxy auth is
 missing in non-Community deployments.** The handler
 previously skipped the proxy-auth validation entirely when
 the token validator was nil — the same misconfiguration
 shape that enabled the agent fallback bypass above. An
 attacker reaching the orchestrator directly could spoof
 `X-Org-ID` for cross-tenant audit attribution. The handler
 now returns 403 if the validator is nil and the deployment
 mode is not Community.
- **`GET /api/v1/decisions/{id}/explain` filters tenant in the
 SELECT clause.** The handler used to look up the audit entry
 by `decision_id` only and post-check the tenant; the
 short-circuit on email failed open whenever the user-email
 column was NULL, and the email check itself was bypassable
 by an attacker who happened to share an email with the
 decision owner across tenants. Now: `X-Tenant-ID` is
 required, the SELECT binds on `(decisionID, callerTenant)`,
 and cross-tenant requests return 404 (not 403) so the
 response shape doesn't leak whether `decision_id` exists in
 another tenant. The post-fetch tenant comparison is kept as
 defense-in-depth.
- **`POST /api/v1/evidence/export` and `GET /api/v1/evidence/summary`
 fail closed when the tenant scope is missing.** Both endpoints
 previously fell back to an empty-string tenant when neither
 `X-Tenant-ID` nor a context-stored `tenant_id` was set, then
 ran SQL with `WHERE tenant_id = ''` — zero rows in practice
 but silently burned a daily-export quota slot for an empty
 bucket and would have leaked data the moment a downstream
 query stopped filtering. Both now return 401
 `TENANT_REQUIRED` when neither source provides a scope.
- **`POST /api/v1/policies/simulate` and
 `POST /api/v1/policies/{id}/impact-report` adopt the same
 fail-closed tenant resolution.** Same header-then-context-
 then-fall-through-to-empty pattern as evidence/export; would
 have shared a global empty-tenant rate-limit bucket when
 called without `X-Tenant-ID`.
- **`POST /api/v1/cost/estimate` and
 `GET /api/v1/plans/{id}/cost` reject anonymous callers.**
 Both substituted a `"_default"` literal for an empty
 `X-Tenant-ID`, so every unauthenticated caller drained the
 same daily quota. Both now return 401 `TENANT_REQUIRED`.
- **`GET /api/v1/audit/tenant/{tenant_id}` requires
 `X-Tenant-ID`.** The URL-vs-session tenant mismatch check
 was gated on a non-empty session tenant, so omitting the
 header bypassed the cross-check entirely. The header is now
 required; mismatches still return 403.
- **`/api/v1/audit/search` enforces tenant scoping from the
 trusted header.** The handler ignored the proxy-injected
 tenant header and only filtered on caller-supplied criteria,
 so a Portal user for tenant A could read tenant B's audit
 logs by POSTing to `/api/v1/audit/search`. The header is now
 required and decoded into a JSON-tag-ignored field so a
 malicious payload cannot override it. The same path also
 silently-disabled tenant filtering on
 `/api/v1/audit/tenant/{id}` because the tenant-only struct
 shape no longer matched after a `StartTime` field was added;
 the new SQL filter fixes that too.
- **`/api/v1/audit/tenant/{tenant_id}` rejects URL paths that
 don't match the session tenant.** Without the cross-check a
 Portal user for tenant A could read tenant B's audit history
 by browsing to `/api/v1/audit/tenant/B`.

#### Enterprise

- **Customer Portal login no longer leaks org existence or auth
 mode.** `POST /api/v1/auth/login` returned three
 distinguishable failure responses that together let an
 unauthenticated caller enumerate valid org IDs and classify
 each org by auth mode:
 - Unknown org: `401 "Invalid credentials"` (no bcrypt work).
 - Known org with no password set (SSO-only): `401 "Password
 authentication not enabled for this organization"` (no
 bcrypt work).
 - Known org, bad password: `401 "Invalid credentials"`
 (full bcrypt compare).
 The distinct no-password body outed which orgs existed and
 which were password-backed; even with a uniform body the
 missing bcrypt on the first two branches leaked the same bit
 through response timing. Every failure now returns `"Invalid
 credentials"`; the no-password branch runs a throwaway
 bcrypt compare against a fixed placeholder hash so the
 timing profile matches a real check. SSO-only orgs cannot
 log in through this path — they are simply indistinguishable
 from wrong-password attempts to an external caller.
- **Customer Portal request-body size capped at 1 MiB.** The
 Portal had no upstream bound on JSON-decode; a single
 multi-GB POST could pin goroutines and memory. The new
 middleware caps POST/PUT/PATCH bodies at 1 MiB by default
 and is wired into the Portal's outer chain so SCIM, admin,
 and session-protected handlers all inherit it.
- **System policies visible in the Customer Portal.** The
 Portal's fetch-static-policies call landed on the agent
 without internal-service credentials and was denied 401, so
 the Static (Read-only) count showed 0 next to a Total
 Policies of 17 — the 80+ PII / SQLi / dangerous-commands
 rules were invisible. Three paired changes restore
 visibility: the agent accepts internal-service credentials
 from headers alongside the hint-based path, the Portal
 signs every agent call with the internal-service secret,
 and CloudFormation injects that secret into the Portal task
 definition. Missing-secret deployments log a startup
 warning and continue with empty static policies so dev
 environments degrade gracefully.
- **`POST /api/v1/admin/onboard-customer` is no longer
 unauthenticated, and supplied `license_key` payloads are
 verified.** The route was registered on the bare router
 with a "legacy / no auth for backward compatibility"
 comment; anyone reachable on the Portal could hit it,
 write rows into the orgs table, mint license keys, and
 overwrite Secrets Manager entries. Two paired fixes close
 the gap: the route now lives under the admin subrouter
 that runs the admin auth middleware (API key required in
 SaaS production; optional otherwise), and when the request
 supplies `license_key` the handler validates the Ed25519
 signature, expiry, and signed org/tier match before
 accepting. The signed payload's `expires_at` and
 `max_nodes` win over the request body — the body cannot
 widen what the license actually grants.

## [7.1.1] - 2026-04-19

Patch release: closes ten Plugin Batch 1 gaps surfaced across two rounds
of post-release install-and-use E2E testing — first with
`@axonflow/openclaw@1.3.0` (six HTTP-path gaps), then with Claude Code /
Cursor / Codex plugins (four MCP-tool-path gaps the first round missed).
All features from v7.1.0 are unchanged in scope; this release makes them
actually work end-to-end for plugin consumers across both the HTTP and
MCP JSON-RPC surfaces.

### Fixed

- **MCP check-input responses now carry richer context.** Block responses
 include `decision_id`, `risk_level`, `policy_matches`, and
 `override_available`/`override_existing_id` when the caller provides
 `X-User-Email`. Previously the agent returned only the legacy
 `allowed`/`block_reason`/`policies_evaluated` trio, so plugins could
 not surface a useful reason on a block or offer an override CTA.
- **`explainDecision` resolves MCP-path decisions.** MCP
 check-input/check-output decisions are now dual-written to
 `audit_logs` with the decision id in `policy_details`, so the
 existing explain endpoint returns the full `DecisionExplanation`
 rather than 404.
- **MCP check-input now consults active overrides.** Previously the
 handler surfaced `override_available: true` but still returned
 `allowed: false` because override enforcement was wired into the WCP
 path only. A flip-to-allow emits an `override_used` audit event
 mirroring the WCP path.
- **Audit search tolerates NULL columns.** `SearchAuditLogs` previously
 aborted the row scan on a NULL `provider`/`model`/`error_message`/`cost`/
 `response_time_ms`/`tokens_used` and dropped the entire result set,
 hiding every Plugin Batch 1 audit row. The scan now uses nullable
 types and maps to zero values for the caller's `AuditEntry`.
- **Cache invalidation on override create matches WCP cache shape.**
 `invalidateCachedDeniedDecisions` previously matched the policy UUID
 against `workflow_steps.policies_matched[].policy_id`, but the WCP
 adapter writes the policy NAME in that slot. The helper now resolves
 UUID + slug + name synonyms and matches any of them, so overrides
 actually flush the WCP cache.
- **WCP-path overrides now apply.**
 `DatabaseDynamicPolicyEngine.EvaluateDynamicPolicies` (used by the WCP
 step gate) now populates `result.AppliedPoliciesDetail`. Previously
 only the in-memory engine did, so `ApplyOverrideToResult` iterated an
 empty slice on the WCP path and no override ever flipped a deny.
- **MCP `tools/call` path now emits richer-context on blocks.** Same
 fix as the HTTP check-input path, mirrored into `mcpToolCheckPolicy`
 and `mcpToolCheckOutput`. Pre-fix, Claude Code / Cursor / Codex
 plugins (which use the MCP server's JSON-RPC surface rather than the
 HTTP endpoint OpenClaw uses) saw a terse "blocked" string with no
 `decision_id` / `risk_level` / `policy_matches` / `override_available`.
 Override apply + audit dual-write are now mirrored identically across
 both surfaces.
- **`createOverride` / `listOverrides` accept UUID *or* slug/name for
 `policy_id`.** Plugins read `policy_id` from a check-input response's
 `policy_matches[]` (where static policies carry the slug, not the
 UUID) and pass that straight to the override endpoints. Pre-fix, the
 orchestrator required the UUID and returned 404 for slug callers.
 `policyRiskAndOverride` now resolves either and stores the canonical
 UUID in `policy_overrides.policy_id`.
- **`DatabaseDynamicPolicyEngine` schema covers the new columns.**
 `dbPolicyEngineSchema()` now includes `id UUID`, `risk_level`, and
 `allow_override` so integration tests and fresh clusters match
 migration 070's shape.
- **`policy_override_repository.policyRiskAndOverride` returns the
 canonical UUID.** Callers can no longer store the user-supplied
 value (which may be a slug) in `policy_overrides.policy_id`.

### Changed

- **Workflow handler `getUserID` falls back to `X-User-Email`.** Matches
 the Plugin Batch 1 convention of per-user identity via the email
 header, so WCP workflows capture per-user scoping and the cache
 invalidation query finds the right rows.

### Internal

- New `platform/agent/mcp_richer_context.go` helper module.
- New install-E2E scenario scripts at
 the e2e test suite
 covering the post-release "install from npm / GitHub release and use
 as a real user would" layer that caught these ten gaps across both
 the HTTP check-input path and the MCP tools/call path.
 `PLUGIN_E2E_TESTING_WORKFLOW.md` now mandates both paths as separate
 install-E2E layers for every future plugin batch.

---

## [7.1.0] - 2026-04-18

Combined release: Workflow State Management & HITL Enhancement +
Plugin Batch 1 — Governed Overrides & Explainability.

### Added

#### Workflow State Management & HITL Enhancement

- **Execution boundary semantics** — Step gate decisions are now idempotent
 by default. Calling the same `(workflow_id, step_id)` returns the cached
 decision without re-running the policy evaluator. Pass
 `retry_policy: "reevaluate"` to force a fresh evaluation when external state
 has changed. Responses include `cached` (boolean) and `decision_source`
 ("fresh" or "cached") so callers always know the provenance of the decision.

- **Workflow checkpoints** — Every step gate evaluation automatically creates
 a checkpoint capturing the decision, policy context, and full step metadata
 (model, provider, tool context, actor identity). Checkpoints are
 governance-aware resume boundaries, not arbitrary snapshots.
 - Community: list checkpoints via `GET /api/v1/workflows/{id}/checkpoints`
 - Evaluation: resume from last checkpoint via `POST /api/v1/workflows/{id}/checkpoints/resume`
 - Enterprise: resume from any checkpoint via `POST /api/v1/workflows/{id}/checkpoints/{id}/resume`

- **Risk-tiered approval routing** — HITL approval requests now carry a
 severity level (critical, high, medium, low) derived from the triggering
 policy's action config or the policy evaluation risk score. When multiple
 policies match, the highest severity wins. The HITL queue can be filtered
 by severity.
 - Enterprise: auto-approve low-risk actions after a configurable delay,
 escalate critical-risk actions past SLA threshold. Configure via
 `AXONFLOW_RISK_TIER_ENABLED`, `AXONFLOW_RISK_TIER_ORG_ID`,
 `AXONFLOW_LOW_AUTO_APPROVE_DELAY_MIN`, `AXONFLOW_CRITICAL_ESCALATION_SLA_MIN`.

- **Deterministic approval deduplication** — WCP approval creation uses a
 deterministic UUID derived from `(workflow_id, step_id)` combined with
 `ON CONFLICT` to guarantee exactly one approval per execution boundary,
 even under concurrent first-time calls.

#### Plugin Batch 1 — Governed Overrides & Explainability

- **Governed session overrides** — users can grant themselves a time-bounded,
 audit-logged override on a policy that would otherwise deny, closing the
 dev-mode UX gap without weakening governance. TTL is clamped server-side
 (default 60 minutes, hard cap 24 hours, zero for critical-risk policies).
 A free-text justification is mandatory on every override. Four new audit
 event types record the full lifecycle: `override_created`, `override_used`,
 `override_expired`, `override_revoked`. New endpoints: `POST /api/v1/overrides`,
 `GET /api/v1/overrides`, `GET /api/v1/overrides/{id}`,
 `DELETE /api/v1/overrides/{id}`.
- **Policy risk level + override flag** — every policy now carries an explicit
 `risk_level` (`low` | `medium` | `high` | `critical`) and an
 `allow_override` boolean. The combination is enforced as a contract: a
 database trigger forces `allow_override=false` whenever `risk_level=critical`,
 and the override creation endpoint rejects with 403 if either condition
 forbids the override. Existing policies are migrated with sensible defaults
 (dangerous commands, RCE, and privilege-escalation categories set to
 `critical`; SQLi, prompt injection, and secret leaks set to `high`).
- **Richer approval context** — `PolicyMatch` now includes `risk_level`,
 `allow_override`, `matched_rule`, and `policy_description` fields. Plugins
 can surface a structured reason on every block rather than a terse string.
 Existing consumers are unaffected — all new fields use `omitempty`.
- **Explain-on-demand endpoint** — `GET /api/v1/decisions/{id}/explain`
 returns a stable `DecisionExplanation` payload: matched policies with
 descriptions, decision + reason, risk level, override availability and any
 existing active override, historical hit count for the same rule in the
 caller's rolling 24-hour session window, and a tool signature. Authorization
 is scoped to the decision owner or same-tenant callers. Payload shape is
 frozen — additive fields only until a major version bump.
- **Audit search filter parity** — `POST /api/v1/audit/search` accepts three
 new optional filters: `decision_id` for explain flows, `policy_name` for
 "what did this policy block" queries, and `override_id` to reconstruct the
 full lifecycle of a single override. Existing filters remain unchanged.
- **MCP tool surface** — `explain_decision`, `create_override`, `delete_override`,
 and `list_overrides` are now exposed as MCP tools on the agent's MCP server,
 alongside the existing `check_policy` / `check_output` / `audit_tool_call`
 / `list_policies` / `get_policy_stats` / `search_audit_events` tools. Agents
 running in the plugin ecosystem can drive the full override lifecycle and
 decision explainability without leaving the MCP surface.

### Changed

- **Step gate upsert** — Re-evaluation (`retry_policy: "reevaluate"`) now
 updates all step metadata (step_name, step_type, step_input, model,
 provider) in the persisted step record, not just the decision columns.

- **Concurrent safety** — After upserting a step decision, the service reads
 back the persisted row to ensure the response matches what actually landed
 in the database. If a concurrent call won the race with a different
 decision, the persisted (winning) decision is returned.

- **Feature matrix** — Updated with checkpoint and risk-tiered approval rows
 across Community, Evaluation, and Enterprise tiers.

- `DynamicPolicy` and `StaticPolicy` structs gained `risk_level` and
 `allow_override` fields. Policy repositories persist them via migration 070.

### Fixed

- **Severity was hardcoded** — HITL approval severity was always set to
 "high" regardless of the triggering policy's risk level. Now derived from
 the policy's `require_approval` action config or the evaluation risk score.

### Database

- Migration `069_*` — workflow state management.
- Migration `070_policy_batch1_risk_and_override_extensions.sql` adds
 `risk_level` and `allow_override` columns (with seeded defaults per category)
 to `static_policies` and `dynamic_policies`; extends the existing
 `policy_overrides` table with `tool_signature`, `revoked_at`, `revoked_by`;
 adds `audit_logs` indexes on `decision_id` for the new filters; installs a
 trigger that enforces the critical-risk no-override invariant at the
 database level.

### Plugin ecosystem

The companion plugin releases for Plugin Batch 1 (OpenClaw v1.3.0,
Claude Code v0.5.0, Cursor v0.5.0, Codex v0.4.0) ship the user-facing
consumption of the new override, explain, and audit-search endpoints.

---

## [7.0.1] - 2026-04-11

### Fixed

- **Authentication on all endpoints** — Unified auth handling across gateway,
 MCP, proxy, and API routes. Fixes 401 errors on community-saas (try.getaxonflow.com)
 for gateway pre-check, audit, proxy, and MCP endpoints. Proxy routes
 (dynamic policies, cost controls) were previously inaccessible in
 community-saas mode.
- **Community mode tenant isolation** — Requests in community mode now
 preserve per-tenant scoping. Previously all requests collapsed to a
 single synthetic client, mixing audit and policy data across tenants.
- **Telemetry tracking** — All authenticated requests (including MCP and
 JSON-RPC sessions) now correctly record telemetry in community-saas mode.
- **Audit identity** — Audit records now use the authenticated client identity
 instead of trusting the request body, preventing cross-tenant attribution.
- **MCP server DB auth** — MCP JSON-RPC handler now validates clients
 registered via database, not just the in-memory whitelist.
- **Example credentials** — 139 example files updated to read auth credentials
 from environment variables, fixing failures on authenticated servers.
- **Deploy workflow** — Stack discovery excludes auxiliary services when
 deploying community-saas.
- **Next.js security update** — Customer portal updated to 16.2.3
 (GHSA-q4gf-8mx6-v5v3).

## [7.0.0] - 2026-04-09

### Breaking Changes

#### Changed — Default detection actions relaxed

- **Breaking:** the default `PII_ACTION` is now `warn` (previously `redact`). SQLi and
 sensitive-data categories also default to `warn`. Compliance categories (HIPAA, GDPR,
 PCI, RBI, MAS FEAT) default to `log`. Only unambiguously dangerous patterns — reverse
 shells, `rm -rf /`, SSRF to `169.254.169.254`, `/etc/shadow`, credential files — block
 by default.

 **Why this is a major version bump:** upgrading without explicit config reduces enforcement.
 A governance product silently weakening default protections is exactly the kind of change
 that warrants a major version signal.

 **Migration path:**
 - To restore previous behavior: set `AXONFLOW_PROFILE=strict` or `PII_ACTION=redact`
 - To keep new defaults: no action needed
 - Explicit `*_ACTION` env vars are unaffected — they always take highest precedence

- **Database migration for system-default policies.** A migration rewrites system-default
 policies to match the new defaults. User-created and tenant-owned policies are untouched.
 An accompanying down migration restores the previous strict defaults.

### Community

#### Added — Community SaaS evaluation server (try.getaxonflow.com)
- `DEPLOYMENT_MODE=community-saas` — new deployment mode for shared evaluation server.
 Requires self-registration via `POST /api/v1/register`. Rate-limited: 20 req/min +
 500 req/day per tenant. Ollama is the only LLM provider. No license required.
- `POST /api/v1/register` — generates UUID tenant_id (prefixed `cs_`) and one-time-display
 secret (bcrypt-hashed at cost 12). Credentials expire after 30 days. IP-rate-limited
 to prevent registration abuse (5/hour/IP).
- Migration 068: `community_saas_registrations` + `community_saas_daily_usage` tables +
 `increment_csaas_daily()` atomic counter function for daily rate limiting.
- Community SaaS usage telemetry to dedicated DynamoDB table (`community-saas-telemetry-events`).
 Records endpoint, method, status_code, platform version, correlation_id per request.
 Never records request content, query params, or IP addresses. 30-day TTL, PITR enabled,
 server-side encryption enabled.
- Ollama EC2 infrastructure template (`infrastructure/cloudformation/ollama-ec2.yaml`)
 with security-group-scoped port 11434, SSM management, GPU driver auto-install for
 g4dn/g5 instance types.
- Dedicated community CloudFormation template (`community-saas-ecs.yaml`) — stripped-down
 stack with Agent, Orchestrator, Prometheus, and Grafana only. No Customer Portal,
 no Portal UI, no enterprise connectors. Deploy script auto-selects the right template
 based on `deployment_mode` in the environment config.
- Docker Compose overlay (`docker-compose.community-saas.yml`) for local E2E testing with
 bundled Ollama service and automatic model pull.
- `community-saas` added to deploy-application and deploy-platform workflow dropdowns.
- Checkpoint telemetry accepts `community-saas` as a valid `endpoint_type` value.

#### Added — Governance profiles and per-category enforce

- **`AXONFLOW_PROFILE` env var** (`dev` | `default` | `strict` | `compliance`). Resolved at agent and orchestrator startup, applied to the policy engine, and logged on boot. A single env var picks the enforcement posture instead of tuning eight individual `*_ACTION` env vars. The matrix is documented in the Governance Profiles guide. Explicit category env vars (`PII_ACTION=block`, `SQLI_ACTION=warn`, etc.) continue to override the profile, so existing automation keeps working.

- **`AXONFLOW_ENFORCE` env var** for per-category opt-in enforcement. Accepts a comma-separated subset of `pii`, `sqli`, `sensitive_data`, `high_risk`, `dangerous_queries`, `dangerous_commands`, plus the sentinels `all` and `none`. `all` is a true alias for the strict profile; `none` is a true alias for the dev profile — both match the documented profile matrices exactly. An explicit category list forces listed categories to `block` while leaving non-listed categories at the active profile's value (non-listed are no longer silently downgraded to `warn`). Unknown tokens are rejected at startup — previously this used `log.Fatalf` which crashed test binaries when developers had stale env vars set; it now returns an error cleanly. Precedence (highest → lowest): explicit `*_ACTION` env vars > `AXONFLOW_ENFORCE` > `AXONFLOW_PROFILE` > built-in defaults.

- **Profile banner at startup.** Both the agent AND the orchestrator now log the active profile and resolved per-category actions on boot, so operators can confirm what posture each component is running in without grepping the env. Example: `[Profile] agent active: dev — PII=log, SQLI=log, SensitiveData=log, HighRisk=log, DangerousQuery=warn, DangerousCommand=warn`.

- **Precedence chain regression tests** — unit tests verify `ProfileDefaults → ApplyEnforce → *_ACTION env var` end-to-end through `DetectionConfigFromEnv`, plus the invalid-value-preserves-profile guarantees under both strict and dev profiles.

#### Fixed — Invalid env var values now preserve the active profile

- **`DetectionConfigFromEnvWithBase` fallback bug.** On a `dev` or `default` deployment, a typo like `PII_ACTION=blok` used to silently tighten behavior back to `redact` — the hardcoded legacy fallback in `parseDetectionAction` ignored the already-resolved profile base and reverted to the v6.1.0 default. Now the fallback preserves the base config's value (`cfg.PIIAction`, `cfg.SQLIAction`, etc.) so an invalid value on a dev profile stays at `log` and on a strict profile stays at `block`. Applies to PII, SQLi, sensitive data, high risk, dangerous queries, and dangerous commands. Regression tests verify the behavior on both strict and dev profiles.

#### Fixed — `AXONFLOW_ENFORCE=all` and `none` now match their documented profile aliases

- **Sentinel semantics corrected.** The comments and docs said `AXONFLOW_ENFORCE=all` was equivalent to `AXONFLOW_PROFILE=strict` and `none` equivalent to `dev`, but the old `ApplyEnforce` implementation turned listed categories into `block` and all others into `warn`. In practice `all` over-blocked `high_risk` (strict leaves it at warn), and `none` produced `warn`-only behavior instead of dev's `log`-only posture for PII/SQLi/sensitive data. `ApplyEnforce` now reads the sentinel and returns `ProfileDefaults(ProfileStrict)` / `ProfileDefaults(ProfileDev)` directly, so the sentinels match the documented profile matrices exactly.

- **Non-listed categories preserved.** When an explicit category list is provided (e.g. `AXONFLOW_ENFORCE=pii,sqli`), listed categories are forced to `block` as before, but non-listed categories now preserve the active profile's value instead of being silently downgraded to `warn`. A dev-profile deployment with `AXONFLOW_ENFORCE=pii` now blocks PII and keeps everything else at `log`, not `warn`.

#### Fixed — `LoadEnforceFromEnv` no longer calls log.Fatalf

- **`LoadEnforceFromEnv` returns an error instead of calling `log.Fatalf`.** Any developer with a stale `AXONFLOW_ENFORCE=garbage` in their shell used to crash the entire test binary at package init. Now the error is returned cleanly and the calling code logs and continues with the profile base.

#### Fixed — `deploy-client.sh` JWT path silent failure

- **`scripts/multi-tenant/deploy-client.sh` no longer silently falls back to a hardcoded Secrets Manager path.** The "Path B" fallback was reading a hardcoded `axonflow/clients/travel/production/user-token` regardless of the client being deployed, swallowing AWS errors with `2>/dev/null || echo ""`, and silently passing an empty `USER_TOKEN` into the container — which the agent then rejected at runtime with a misleading "token signature is invalid" error. The variable `AXONFLOW_STACK_PREFIX_JWT` is now required; the script fails loudly if missing. The generated `USER_TOKEN` is now validated with a structural check: three base64url segments, header that decodes to JSON with an `alg` field, payload that decodes to JSON with an `exp` or `iat` field (previously the check was a regex that accepted any `a.b.c` literal). All client environment files under `configs/environments/clients/` have been updated to declare the variable. A new runbook documents the underlying JWT secret rotation flow.

#### Fixed — Evaluation tier `MaxPendingApprovals` outlier

- **`EvaluationLimits.MaxPendingApprovals` corrected from 100 to 25** to match the rest of the evaluation tier caps (`MaxConcurrentExec`, `MaxSSEConnections`, `MaxVersionsPerPlan`). The previous value of 100 was an outlier that contradicted the tier boundary test and inflated evaluation-tier capacity above what was documented and tested.

### Security

- **Ed25519 enterprise license signing key rotated.** The previous private seed was found embedded in `scripts/setup-e2e-testing.sh`, where it had been since the script was authored. Anyone with read access to the repo could mint valid Enterprise / Professional / Plus licenses for any `org_id`, bypassing tier gating in any deployment. As part of this release the key has been rotated, all active customer and per-stack licenses re-signed under the new key, and the agent's embedded `enterprisePublicKey` byte array updated. The previous public key (first 8 bytes `9a b6 f6 b2`) is no longer accepted. A new internal-only runbook documents the rotation procedure for any future operator.

- **Rotation tool now enumerates secrets dynamically.** The initial rotation tool held a hardcoded list of license secrets, which missed the per-stack `axonflow-<stack>-license-key` boot license secrets and broke running agents mid-rotation. The rewritten tool paginates `ListSecrets` and `DescribeParameters` across all configured regions, filters by name + value prefix, re-signs every enumerated Ed25519 and legacy V2 license, and writes re-signed licenses back to AWS BEFORE rotating the signing-key secret (so a write-back failure never leaves SM in a split-brain state where the new signing key is active but some licenses still hold signatures under the old key).

- **Re-signed V2 licenses preserve both `tenant_id` and `org_id`.** The legacy V2 HMAC format only carried `tenant_id`; the fresh Ed25519 payload now writes both fields so downstream consumers that key off either stay compatible.

- **`scripts/setup-e2e-testing.sh` no longer hardcodes any signing keys.** The eval and dev-only enterprise keys are sourced from the environment (CI uses GitHub Actions secrets) or fetched at runtime from AWS Secrets Manager. A separate dev-only enterprise keypair has been created so local E2E never touches the production signing key. The `.env` file written by the script is `chmod 600` so the signing-key material it contains is not world-readable.

- **Pre-commit `gitleaks` rule** added at `.gitleaks.toml` and wired into `.pre-commit-config.yaml`. The rule blocks any commit that introduces a base64 Ed25519 seed near a `*_SIGNING_KEY` env var assignment. CI runs gitleaks on every PR.

- **Checkpoint telemetry retention bumped from 90 → 180 days.** Evaluation-to-production conversion windows run 2-4 months in observed data, so 90 days was cutting off the tail. 180 days still fits comfortably in DynamoDB free tier at current volume.

#### Fixed — Multi-tenant SaaS correctness and security

- **`X-Org-ID` now derived from the validated client license, not the deployment env var.** The agent's Single Entry Point proxy middleware (`platform/agent/proxy.go`) was forcibly overwriting the authenticated client's `org_id` with the deployment's `ORG_ID` environment variable on every request, preventing a single deployment from serving multiple organizations. Every tenant on a shared stack was being stamped with the same `org_id`, making true multi-tenant workflow scoping impossible. The middleware now forwards `X-Org-ID` from the cryptographically validated client license payload (`client.OrgID`) — matching the behavior of `apiAuthMiddleware` in `auth.go`, which was already correct. The Ed25519 signature on the client license guarantees the `org_id` claim cannot be forged, so trusting it is both safe and required for multi-tenant operation. Deployments with a single org per stack are unaffected; deployments serving multiple orgs now correctly scope workflows, policies, and audit data per-tenant.

- **Internal orchestrator forwarding path fixed.** `platform/agent/run.go` also had the same bug in the direct HTTP forwarding path that bypasses the Single Entry Point mux. It was checking whether the client had an `org_id` and then setting the header to `getDeploymentOrgID()` anyway. Now uses `client.OrgID` directly.

- **MCP check-input and check-output audit log OrgID.** `platform/agent/mcp_handler.go` was writing every MCP audit record with `OrgID: getDeploymentOrgID()` regardless of which client authenticated. Multi-tenant audit trails were structurally broken — all records from all tenants were attributed to the deployment. Both handlers now lift `orgID` into function-level scope alongside `tenantID`, populated from `client.OrgID` in enterprise auth, `X-Org-ID` header in internal-service auth, and `getDeploymentOrgID()` in community mode.

- **Removed `validateClient()` mock authentication fallback.** `platform/agent/run.go` had a `validateClient(clientID)` function that accepted any `client_id` from the request body and returned a fake "Demo Client" with the deployment's own `org_id`, no credential validation. All four MCP handlers (`/api/v1/mcp/query`, `/api/v1/mcp/execute`, `/api/v1/mcp/check-input`, `/api/v1/mcp/check-output`) called this as a fallback when Basic auth was missing. Effectively: in enterprise mode, any request without Basic auth but with a `client_id` field in the JSON body was silently authenticated as that client. Removed the function and all four call sites now reject unauthenticated requests with 401.

- **Orchestrator workflow tenant/org ownership checks.** `platform/orchestrator/workflow_control/service.go` — **nine** service methods now enforce tenant/org ownership before acting on a workflow: `GetWorkflow`, `StepGate`, `MarkStepCompleted`, `ApproveStep`, `RejectStep`, `ResumeWorkflow`, `CompleteWorkflow`, `FailWorkflow`, `AbortWorkflow`. Previously `GetWorkflow` (called from `GET /api/v1/workflows/{id}`) did no tenant/org filtering — any authenticated client that knew a workflow ID could fetch any workflow (classic IDOR). The same gap existed on every other workflow state transition: an attacker could approve, reject, resume, complete, fail, or abort any other tenant's workflow, or inject fake cost/token metrics into another tenant's audit trail by calling `MarkStepCompleted`. All matching HTTP handlers in `handlers.go` extract tenant/org from request headers (`X-Tenant-ID`, `X-Org-ID`) and pass them through. Callers in `run.go` (MAP confirm mode) and `unified_execution_handler.go` also updated. `ListWorkflows` was already filtering correctly.

- **Unified execution handler `checkTenantOwnership` hardened.** `platform/orchestrator/unified_execution_handler.go` previously had permissive fallbacks: requests without `X-Tenant-ID` were allowed through, and executions without a `tenant_id` were accessible to any caller. Both were cross-tenant data leak vectors. The check now:
 - Requires **both** `X-Tenant-ID` and `X-Org-ID` on every request (401 if missing).
 - Rejects executions that lack either `tenant_id` or `org_id` (404).
 - Requires exact match on both fields (404 on any mismatch).
 - All mismatch responses return 404 (not 403) to prevent cross-tenant existence leakage.

#### Added — Customer portal multi-tenant identity

- **`tenant_id` column on `user_sessions`** (migration 065). The customer portal previously aliased `tenantID:= orgID` in `auth.go` with the comment *"organizations table doesn't have tenant_id column"*. That collapsed two concepts and prevented a single portal org from representing multiple tenants (prod, staging, dev). The new column lets a portal session track which tenant within an org the user is currently viewing.

- **`portal_default_tenant_id()` SQL helper** (migration 065). Resolves the default tenant for an org: prefers `tenant_id = org_id` (canonical default) and falls back to the oldest tenant in the `tenants` table, then to `org_id` itself for community deployments. Used at login time to populate the session.

- **Automatic default tenant backfill** for every existing organization (migration 065). Every org gets a canonical tenant row inserted into the `tenants` table if one doesn't already exist, so portal login can deterministically resolve a tenant without schema changes to customer data.

#### Changed — Customer portal auth and proxy

- **`AuthHandler.HandleLogin`** now resolves `defaultTenantID` via `portal_default_tenant_id()` at login time, inserts it into `user_sessions.tenant_id`, and returns both `org_id` and `tenant_id` in the login response. Legacy fallback kicks in if migration 065 hasn't been applied yet.

- **`AuthHandler.HandleCheckSession`** (GET /api/v1/auth/session) now reads and returns `tenant_id` alongside `org_id`.

- **`middleware/dev_auth.go`** stops joining `customers.tenant_id` and reads `user_sessions.tenant_id` directly. The previous `orgID + "_tenant"` fallback is replaced with a deterministic fallback to `org_id` for legacy sessions.

- **`api/orchestrator_proxy.go`** forwards `X-Tenant-ID` from `session.TenantID` (the currently-selected tenant within the org) and `X-Client-ID` from the tenant identifier — previously both collapsed to `session.OrgID`. `X-Org-ID` continues to carry `session.OrgID`. A warning log fires when `session.TenantID` is empty (legacy session, unexpected after migration 065).

- **`ORG_ID` environment variable role clarified.** Previously documented as "canonical org identity (single source of truth)", the env var is now understood as:
 - **Stack-level deployment label** (used in logs, metrics, startup validation against the stack's own boot license)
 - **Community mode fallback** (when no client license is present)
 - **NOT a routing key** for per-request multi-tenant data scoping — that comes from the authenticated client license

#### Fixed — Deployment tooling

- **`deploy-cloudformation.sh` missing required `OrganizationID` parameter.** The script built the `aws cloudformation deploy --parameter-overrides` list without passing `OrganizationID`, so creating a new stack from a clean state failed with `Parameter 'OrganizationID' must have a value`. Existing stack updates worked because CloudFormation falls back to `UsePreviousValue` for parameters not passed explicitly. The script now reads `deployment.organization_id` from the environment yaml config, falling back to the environment name if not set, and passes it on every deploy. This unblocks creating fresh environments from `deploy-platform.yml`.

### Security

- **IDOR on `GET /api/v1/workflows/{id}` closed.** Before v6.2.0, any authenticated client could fetch any workflow by ID regardless of which tenant or org it belonged to. Combined with the `X-Org-ID` deployment-env-var override, this meant a compromised tenant could enumerate workflow IDs and read every other tenant's execution state. Both the header source fix and the service-layer ownership check are required to close the hole end-to-end.
- **No-auth fallback on MCP handlers closed.** Before v6.2.0, in enterprise mode, any request with a `client_id` field in the JSON body (but no Basic auth credentials) was silently authenticated as that client and attributed to the deployment's own org. Removed entirely.
- **Permissive cross-tenant fallback on unified execution endpoints closed.** Before v6.2.0, executions without a `tenant_id` were accessible to any caller, and requests without `X-Tenant-ID` were accepted. Both now rejected.

---

## [6.1.0] - 2026-04-06

### Community

#### Added

- **Mistral AI LLM provider.** Full integration with Mistral's OpenAI-compatible API. Supports `mistral-small-latest` (default), `mistral-large-latest`, `codestral-latest`, and other models. Includes streaming, cost estimation, health checking, and automatic bootstrap from `MISTRAL_API_KEY` environment variable. Six example suites with 42 total assertions.
- **Cursor IDE plugin launch.** AxonFlow governance for Cursor via `preToolUse`/`postToolUse` hooks. Enforces policy on Shell, Write, Edit, Read, Task, NotebookEdit, and MCP tools. PII detection in file writes with configurable `PII_ACTION` (block, redact, warn, log). 3 skills, 1 governance rule, 6 MCP tools. Plugin at [axonflow-cursor-plugin](https://github.com/getaxonflow/axonflow-cursor-plugin).
- **OpenAI Codex plugin launch.** Hybrid governance for Codex: enforcement via hooks for terminal commands (`exec_command`), advisory governance for other tools via skills with implicit activation. 6 skills, 6 MCP tools. Plugin at [axonflow-codex-plugin](https://github.com/getaxonflow/axonflow-codex-plugin).
- **Integration activation for Cursor and Codex.** Auto-detection via connector type prefix (`cursor.*`, `codex.*`) and client name matching. Integration-specific policies enabled on first request (migration 064).
- **GovernedTool examples for TypeScript, Go, Java.** Framework-agnostic tool governance examples matching the existing Python example, with 8 E2E-verified test cases per language.

#### Changed

- **Telemetry defaults clarified for SDKs and plugins.** Anonymous telemetry remains enabled by default for all endpoints, including localhost/self-hosted evaluation, unless `DO_NOT_TRACK=1`, `AXONFLOW_TELEMETRY=off`, or an explicit SDK/plugin setting disables it. Related docs now also describe plugin timeout tuning for remote or high-latency deployments.

---

## [6.0.0] - 2026-04-05

> **Upgrade note:** Most users running with default settings are unaffected. If you customized `ORG_ID` or `AXONFLOW_CLIENT_ID` in your docker-compose, verify they still match your deployed identity before upgrading. See [deployment/licensing](https://docs.getaxonflow.com/docs/deployment/licensing) for details.

### BREAKING CHANGES

- **Unified identity model.** `tenant_id` (from Basic auth `clientId`) for data isolation, `org_id` (from deployment `ORG_ID` env var) for entitlement scope. SDKs send credentials, server derives identity — no client-supplied identity headers.
- **License payload field renamed: `tenant_id` → `org_id`.** Existing licenses with `tenant_id` will not be recognized; regenerate with the updated keygen tool.
- **`X-Client-ID` header removed.** Redundant with `X-Tenant-ID`. All orchestrator reads changed to `X-Tenant-ID`.
- **License `org_id` must match deployment `ORG_ID`.** Agent validates at startup; mismatch causes a fatal error.
- **`X-Tenant-ID` header no longer accepted from clients.** The server derives tenant context from OAuth2 Client Credentials (Basic auth). SDKs must be updated to v5.0+ (Python), v5.0+ (Go), v5.0+ (TypeScript), v5.0+ (Java).
- **Legacy DatabasePolicyEngine removed.** All policy evaluation flows through the unified SharedPolicyEngine.
- **Basic auth required in evaluation/enterprise mode.** All proxied API endpoints require `Authorization: Basic base64(clientId:clientSecret)` when `DEPLOYMENT_MODE` is not `community`.

### Community

#### Added

- **`tenants` table** (migration 062) maps tenant_id → org_id. Auto-populated on first authenticated request. Enables multi-tenant deployments (prod, staging, dev under one org).
- **`org_id` column** on `audit_logs` (migration 059) and `mcp_query_audits` (migration 061) with backfill from `tenant_id`. All audit write paths now populate `org_id`.
- **Auto-registration of organizations and tenants.** In-memory cache skips DB on subsequent requests. Self-hosted users never need to manually seed identity tables.
- **Claude Code plugin** ([getaxonflow/axonflow-claude-plugin](https://github.com/getaxonflow/axonflow-claude-plugin)) — automatic policy enforcement, PII scanning, and audit trails via PreToolUse/PostToolUse hooks and 6 MCP tools.
- **MCP server protocol endpoint** (`/api/v1/mcp-server`). JSON-RPC 2.0 over Streamable HTTP with 6 governance tools: `check_policy`, `check_output`, `audit_tool_call`, `list_policies`, `get_policy_stats`, `search_audit_events`.
- **Integration policy activation system.** Integration-specific policies auto-enabled when an integration is detected via `AXONFLOW_INTEGRATIONS` env var, connector type auto-detection, or MCP client identification.
- **10 dangerous command system policies** (migration 059): reverse shells, destructive filesystem ops, credential access, download-and-execute, SSRF, path traversal, dynamic code execution.
- **`DANGEROUS_COMMAND_ACTION` config** split from `DANGEROUS_QUERY_ACTION`. Different risk profiles, configured independently.
- **OAuth2 Client Credentials authentication** for all policy API endpoints.
- **Community mode identity headers.** Agent injects `X-Tenant-ID` and `X-Org-ID` in community mode. Orchestrator identity always server-derived.
- **MCP handler Basic auth support.** All 4 MCP handlers accept Basic auth (service license validation), falling back to legacy whitelist.
- **Startup org_id mismatch validation.** Agent fails fast if license `org_id` doesn't match deployment `ORG_ID`.
- **Response PII detection uses database-driven policy engine.** Shared engine wired in orchestrator for response scanning.
- **PII detection modes example** (`examples/pii-detection/http/pii-modes.sh`). Tests request-side and response-side PII with ISO timestamp false positive regression test.
- **Proxy routes** for MCP processing, MAP cost estimation, unified execution cancel, legacy policy reads.
- **Runtime table creation moved to migrations.** `audit_logs`, `dynamic_policies`, `policy_metrics`, `media_governance_config`.
- **Organization and Tenant Identity Separation.
- **Setup script repo override.** `COMMUNITY_REPO` environment variable in `setup-e2e-testing.sh` allows pointing community-mode testing at any repo path.

#### Changed

- **All example CLIENT_ID defaults standardized to `"community"`.** Previously random per-example defaults.
- **All examples migrated to Basic auth.** 15 examples converted from `X-Client-ID`/`X-Client-Secret` headers.
- **All examples use agent single entry point.** 106 files migrated from orchestrator-direct (port 8081) to agent (port 8080).
- **`PII_ACTION` environment variable** controls enforcement on both request and response sides: `block`, `redact` (default), `warn`, `log`.
- **Static policy API endpoints** protected by `apiAuthMiddleware` via gorilla/mux subrouter.
- **License keygen parameter renamed.** `tenantID` → `orgID`.
- **Enterprise compose stale V2 secret removed.** `AXONFLOW_CLIENT_SECRET` default cleared. Use `setup-e2e-testing.sh` to generate valid Ed25519 licenses.
- **Orchestrator `ORG_ID` fallback changed from `"default"` to `"local-dev-org"`.** Logs a warning when not explicitly set.

#### Removed

- **`DatabasePolicyEngine`** (`db_policies.go`, ~744 lines).
- **`StaticPolicyEngine`** struct and methods (~634 lines collapsed to ~39 lines).
- **`db_policies_test.go`** (~1,648 lines), **`static_policies_test.go`** (~1,964 lines), **`agent_bench_test.go`** (~400 lines).

#### Fixed

- **Agent auth collapsed tenant_id and org_id.** Now `TenantID` comes from Basic auth clientId, `OrgID` from deployment `ORG_ID` env var.
- **Community mode X-Tenant-ID was spoofable.** Now always overrides with server-derived value.
- **Response PII redaction now respects `PII_ACTION` env var.** `warn`/`log` modes skip redaction but still run detection for audit.
- **4 PII false positives on ISO timestamps** (migration 063). SSN, phone, bank account, Singapore UEN patterns tightened.
- **MCP execute/check-input/check-output handlers ignored Basic auth.** All 4 handlers now use same auth pattern.
- **check-input/check-output rejected Basic auth requests.** `tenant_id` validation moved to after authentication.
- **Validator substring matching** in policy evaluator. Fixed with word-boundary matching.
- **System policies counted against tenant limit.** System-tier policies now excluded from quota.
- **MAP confirm mode end-to-end.** Three bugs fixed (org_id forwarding, execution tracker sync, response envelope).
- **13 HTTP examples missing Basic auth.** `AUTH_B64` variable defined after migration.
- **Compliance module log messages misleading in community mode.** Now shows "routes inactive — Enterprise build required".
- **SSE streaming missing `X-Tenant-ID`.** Updated 6 examples.
- **Cloud-storage example SDK API mismatch.** Updated for SDK v4.3.0.
- **Version-check example SDK struct mismatch.** Rewrote to use raw HTTP.
- **Policy example used wrong agent paths.** Updated to `/api/v1/static-policies`.
- **Support-demo Docker build.** `go.sum` was gitignored under `examples/`. Changed Dockerfile to use `go mod tidy`. Docker network name configurable via `AXONFLOW_NETWORK` env var.
- **Python 3.10+ compatibility in test scripts.** `test-all.sh` and `demo.sh` now respect `PYTHON` env var.
- **Proxy community mode tenant injection.** Agent proxy now derives tenant from Basic auth `clientId` (or defaults to `community`).
- **`AXONFLOW_CLIENT_SECRET` not exported in evaluation mode.** Setup script now exports both `LICENSE_KEY` and `CLIENT_SECRET`.
- **Enterprise setup reused stale `DEPLOYMENT_MODE=evaluation` from.env.** `start_enterprise()` now explicitly sets `DEPLOYMENT_MODE=enterprise`.
- **Community mode `org_id` defaulted to `"demo-org"`.** Changed to `getDeploymentOrgID()` (resolves to `"local-dev-org"` by default).

### Enterprise

#### Added

- **Missing proxy routes for enterprise endpoints.** Policy simulation, evidence export, RBI/SEBI compliance, webhooks, media governance config.

#### Changed

- **Static policy API auth middleware.** All 12 endpoints use `apiAuthMiddleware`.
- **MAP confirm/step mode execution.** WCP workflows correctly store `org_id`. Resume handler syncs execution tracker.

#### Fixed

- **Circuit breaker routes bypassed auth.** All routes now use auth-protected subrouters.
- **Auth middleware didn't inject identity headers.** `apiAuthMiddleware` now sets `X-Tenant-ID` and `X-Org-ID`.
- **MCP permission evaluator rejected `mcp:*:*` wildcard.**
- **HITL queue creation failed with nil JSON context.**
- **Enterprise HITL handler missing `/api/v1/hitl/status` endpoint.**
- **MCP enterprise examples missing `client_id` and `user_token` in request body.**
- **Tier-limits example used Bearer auth instead of Basic auth.**
- **Bedrock inference profile ID** missing `us.` prefix.

### SDK

#### Fixed

- **Missing `status` field on `PlanResponse`** across Go, Python, and TypeScript SDKs.
- **All SDKs reject `client_secret` without `client_id`** to prevent wrong-tenant data storage.
- **Bedrock inference profile ID** in E2E setup script.

---

## [5.5.0] - 2026-04-01

### Community

#### Added

- **OpenClaw integration**: E2E examples and architecture documentation for the `@axonflow/openclaw` plugin. Demonstrates tool input governance, outbound message scanning, and audit logging using `openclaw.*` connector types.
- **Computer Use governance**: E2E examples for Anthropic Computer Use with `ComputerUseGovernor` (Python SDK) and raw HTTP tests. Covers bash command blocking, PII detection, credential exfiltration prevention, and output redaction.
- **Claude Agent SDK integration**: TypeScript example demonstrating MCP tool governance with Claude Agent SDK using existing `mcpCheckInput`/`mcpCheckOutput`.
- **GovernedTool E2E examples**: LangChain AgentExecutor, LangGraph ToolNode, and HTTP examples for framework-agnostic tool governance.
- **SSRF prevention**: Pre-flight URL validation (scheme allowlist, DNS resolution, private IP blocking) on SSO metadata fetch and media URL fetch, complementing existing socket-level protections.
- **Log injection prevention**: Sanitized user-controlled values in log statements across agent proxy, orchestrator, and HITL handler to prevent newline/ANSI injection.
- **Dockerfile hardening**: Non-root user directives, pinned base image tags, and health checks across all Dockerfiles.
- **Go binary hardening**: Strip debug symbols, symbol tables, and build paths from production binaries.
- **Source map prevention**: Disabled source map generation in frontend Docker builds to prevent source code exposure.

#### Changed

- **Docker Compose version default**: Updated `AXONFLOW_VERSION` from `5.1.0` to `5.5.0`. The stale default caused missing endpoints (e.g., `audit/tool-call`) for users running `docker compose up` without explicitly setting the version.

#### Security

- **Amadeus connector SSRF enforcement**: Added pre-flight URL validation for Amadeus connector callbacks.
- **SQL injection prevention in demo backends**: Demo backends now use read-only transactions to prevent SQL injection in example queries.
- **Version alignment CI check**: New CI workflow validates that version defaults in Docker Compose, Dockerfiles, and CHANGELOG stay in sync.

#### Fixed

- **Stale docker-compose/Dockerfile version defaults**: Updated hardcoded version defaults from `5.1.0`/`4.8.0` to `5.5.0` across Docker Compose files and Dockerfiles.

- **Broken docs links**: Fixed 15+ stale links across platform surfaces (AWS Marketplace, SCIM, axonctl, Cloudflare Access setup).
- **Spring Boot/Tomcat update**: Bumped Spring Boot to 3.5.13, Spring Framework to 6.2.17, and Tomcat to 10.1.52 in integration example (CVE fixes).
- **Dependency update**: Bumped `golang.org/x/image` to v0.38.0, fixing out-of-memory vulnerability via crafted TIFF file.

#### Documentation

- **Computer Use governance architecture**: Sampling loop governance boundary, tool action taxonomy, default blocked bash patterns.
- **OpenClaw integration architecture**: Plugin hook flow, connector type convention, approval flow integration, lightweight HTTP client design.

### Enterprise

#### Added

- **Infrastructure hardening**: CloudFormation template updated with RDS private access, restricted security group egress, KMS encryption for SNS/Secrets Manager/CloudWatch, HTTP-to-HTTPS redirect, and ALB invalid header dropping. Terraform modules updated with KMS encryption for DynamoDB, CloudWatch, and Secrets Manager, plus Lambda X-Ray tracing.
- **GovernedTool integration comparison**: Internal documentation comparing GovernedTool, tool_output_wrapper, and mcp_tool_interceptor across framework compatibility, governance scope, and deployment patterns.

---

## [5.4.1] - 2026-03-30

### Community

#### Fixed

- **Cloud storage connectors now available in Community edition**: S3, Azure Blob, and GCS connectors were implemented in the community code path but only registered in the enterprise connector factory. Moved registration to the community factory so all users can use cloud storage connectors without an enterprise license.

#### Added

- **Cloud storage connector examples**: New E2E examples for S3/MinIO operations with hardened assertions in HTTP, Go, Python, TypeScript, and Java (`examples/mcp-connectors/cloud-storage/`).
- **MinIO service in community Docker Compose**: Added MinIO to `docker-compose.yml` for local S3-compatible storage testing without requiring enterprise mode.

---

## [5.4.0] - 2026-03-25

### Community

#### Security

- **Log injection prevention** (CodeQL): Sanitize user-controlled values in log statements across agent proxy, WCP service, and HITL handler using `logutil.Sanitize()`. Prevents newline/ANSI injection into structured logs. Affects `platform/agent/proxy.go`, `platform/orchestrator/workflow_control/service.go`, `platform/orchestrator/hitl_wcp_community.go`.

#### Added

- **Policy conflict detection**: New `POST /api/v1/policies/conflicts` endpoint analyzes active policies for contradictions (`contradictory_action`), shadows, and redundancies. Helps teams validate policy configurations before deploying changes. Available at Evaluation tier and above, sharing the simulation rate limiter.
- **Policy simulation examples**: 8-step deterministic E2E examples in HTTP/cURL, Python, TypeScript, Go, and Java demonstrating simulate, impact report, and conflict detection workflows.
- **LangGraph tool output enforcement example**: Python example demonstrating `tool_output_wrapper()` for policy enforcement on local `@tool` outputs in LangGraph workflows.
- **LangGraph 1-line wrapper example**: New `langgraph_wrapper_example.py` demonstrating `wrap_langgraph()` for transparent governance of compiled LangGraph StateGraphs without modifying the graph definition.
- **Per-tool governance in HTTP example**: `workflow-control.sh` now uses the `tool_context` field in step gate requests for tool_call steps, demonstrating structured tool-level policy evaluation.

### Enterprise

#### Security

- **Log injection prevention** (CodeQL): Sanitize user-controlled values in checkpoint-service and customer-portal log statements. Affects `ee/platform/checkpoint-service/pkg/{notification,handler,bakeoff}`, `ee/platform/customer-portal/api/orchestrator_proxy.go`.
- **Prototype pollution fix** (Dependabot GHSA-rf6f-7fwh-wjgh): Updated `flatted` dependency in customer-portal-ui via `npm audit fix`.

#### Added

- **Portal: Policy Simulation Modal**: "Simulate Policies" button on the Policies page for dry-running all active policies against test queries. Shows allowed/blocked status, risk score, applied policies, and daily usage.
- **Portal: Policy Impact Modal**: "Preview Impact" per-policy button for batch-testing a policy against multiple inputs. Displays match/block rates with per-input results table. Auto-detects conflicts on the target policy.
- **OpenAPI spec**: Added `POST /api/v1/policies/conflicts` endpoint definition.

---

## [5.3.1] - 2026-03-24

### Community

#### Added

- **Audit compliance summary endpoint**: `POST /api/v1/audit/summary` returns aggregated compliance stats for a date range including total events, breakdown by severity and action type, top triggered policies, and a compliance score. Used by the Customer Portal audit page.

#### Fixed

- **Cross-tenant dynamic policy cache collision**: Dynamic policy cache was keyed by policy name, causing policies with the same name across different tenants to silently overwrite each other. In multi-tenant deployments, this could result in step gate evaluations using the wrong tenant's policy or skipping policies entirely due to tenant mismatch. Cache key changed from `name` to `policy_id` to ensure all policies coexist regardless of naming. Includes `GetPolicy()` fallback search by name field for backward compatibility.
- **step_input/tool_input field resolution in dynamic policies**: Dynamic policy conditions referencing `step_input.*` and `tool_input.*` fields now resolve correctly during step gate evaluation. Previously these fields were not extracted from the policy evaluation context, causing conditions like `step_input.query contains "DROP"` to never match.
- **Step gate policy matching for step_input fields**: Fixed policy matching logic to correctly evaluate conditions against step_input fields in the dynamic policy engine. Added comprehensive test coverage for step_input and tool_input condition matching.

### Enterprise

#### Added

- **SSO metadata URL fetcher**: `POST /api/v1/sso/fetch-metadata` in the Customer Portal fetches and parses SAML IDP metadata from a URL. Includes SSRF protection (HTTPS-only, private IP rejection, DNS validation), per-session rate limiting (5/min), 1MB response size limit, and automatic provider detection (Okta, Azure AD, Google, OneLogin, Auth0).

#### Fixed

- **Portal proxy missing headers**: Customer Portal orchestrator proxy now forwards `X-Org-ID` and `X-Client-ID` headers from session context, fixing 401 errors on SEBI compliance endpoints and other handlers that require these headers.
- **SEBI audit export integer-only org IDs**: SEBI audit export service migrated from `int orgID` to `string tenantID` for consistency with the rest of the platform. Portal tenants with string IDs (e.g., `travel-us`) now work correctly with SEBI endpoints.
- **SEBI org name lookup**: `getOrgName` now queries `org_id` column first (matching the varchar tenant ID from portal), with fallback to numeric `id` for backward compatibility.
- **Compliance page crash on EU AI Act data**: Fixed `StatusBadge` component crash when `status` is undefined. Added null-safety guard. Also fixed `getEUAIActConformity()` API function to transform the backend list response (`{assessments: [.]}`) into the single-object shape (`{status, risk_level, last_assessment, requirements}`) expected by the compliance page UI.
- **SCIM page smoke test false positive**: Playwright smoke test `afterEach` filter now catches browser-level "Failed to load resource: 403/404" console errors that lack endpoint URL context, preventing false failures on the SCIM settings page when SCIM provisioning is not configured.

---

## [5.3.0] - 2026-03-17

### Community

#### Added

- **Circuit breaker error auto-trip**: Upstream LLM errors (orchestrator hard failures, orchestrator-level errors, proxy 502s) now automatically trip client-scoped circuits after threshold exceeded within a sliding window. Previously, `RecordError` was implemented but not wired into the request pipeline.
- **Sliding window for circuit breaker thresholds**: Error and policy violation counting now uses a time-windowed approach (default 5 minutes) instead of lifetime counters. Errors outside the window are automatically discarded.
- **Per-tool governance examples**: LangGraph adapter examples for TypeScript, Go, and Java demonstrating per-tool gate checks within tools nodes.
- **WCP guide updated**: Workflow Control Plane documentation expanded with TypeScript, Go, and Java LangGraph adapter examples alongside Python.

### Enterprise

#### Added

- **Per-tenant circuit breaker thresholds**: Tenants can override global circuit breaker defaults (error threshold, violation threshold, window duration, timeout, auto-recovery) via `GET/PUT /api/v1/circuit-breaker/config`. Null fields fall back to global defaults. In-memory cache with 1-minute TTL.
- **Circuit breaker notification fan-out**: Auto-trip events trigger notifications via webhook (HMAC-SHA256 signed), Slack (Block Kit), or PagerDuty (Events API v2). CRUD endpoints at `/api/v1/circuit-breaker/notifications`. Includes SSRF protection (private IP rejection) and retry with exponential backoff.
- **SDK circuit breaker observability**: New methods across all 4 SDKs: `GetCircuitBreakerStatus`, `GetCircuitBreakerHistory`, `GetCircuitBreakerConfig`, `UpdateCircuitBreakerConfig`.

#### Fixed

- **Customer Portal UI fixes**: SaaS dashboard rendering, navbar overflow on long org names, graceful 404 handling, sidebar navigation cleanup, and React hooks ordering fix.

#### Docs

- **Customer Portal access guide**: Step-by-step guide for enterprise portal authentication, JWT setup, and role-based access.

---

## [5.2.0] - 2026-03-14

### Community

#### Security

- **Proxy route authentication**: Agent gateway now validates client credentials on all proxied `/api/v1/*` routes before forwarding to backend services. Previously, proxy routes forwarded requests without authentication.
- **Proxy auth token hardening**: Reject static fallback proxy token when `AXONFLOW_INTERNAL_SERVICE_SECRET` is configured; only HMAC-signed tokens accepted in hardened deployments.

#### Added

- **Tool call audit endpoint**: `POST /api/v1/audit/tool-call` records non-LLM tool call audit entries (API calls, MCP executions, function invocations) for compliance tracking. Includes Basic auth enforcement and 1MB request body size limit.
- **Audit query SDK methods**: `GetAuditLogsByTenant` and `SearchAuditLogs` for programmatic audit log retrieval with pagination and filtering. Supported in all 4 SDKs (v4.1.0+).

#### Fixed

- Allow tenant/client ID mismatch on proxy-verified requests where the Agent maps client IDs to different tenant IDs (e.g., `healthcare-demo` -> `healthcare_tenant`)
- AWS Marketplace CloudFormation template updated to v5.0.0
- Deploy workflow resolves version from ECR instead of HEAD
- Migration 122 FK ordering fix + GCP secret backup docs

---

## [5.1.0] - 2026-03-12

### Community

#### Security

- **`check-input` parameter scanning**: The `check-input` endpoint now inspects `parameters` field values individually for SQLi, PII, and compliance violations. Previously, a caller could pass a benign `statement` while embedding payloads in parameters that bypassed all policy checks. Each parameter value is scanned independently by the static policy engine; string values are scanned directly, nested objects/arrays are JSON-serialized before scanning, numeric values are converted to strings for PII/compliance detection, and boolean values are skipped.

#### Added

- **Audit: parameter tracking in MCP query audits**: Added `parameters_hash` (SHA-256) and `parameter_count` columns to `mcp_query_audits` table for forensic analysis of check-input requests. Migration: `057_mcp_audit_parameters.sql`
- **Dynamic policy: parameter condition fields**: Dynamic policies can now match on `parameters.<key>` (individual parameter values) and `parameter_count` (number of parameters) as condition fields

### Enterprise

#### Added

- **Execution Timeline page**: New customer portal page showing unified MAP and WCP execution history with real-time status, step-level drill-down, cost tracking, and policy decision visibility. Supports filtering by execution type and status, pagination, and keyboard-accessible expandable rows.
- **HITL Approval Flow Dashboard**: New customer portal page for human-in-the-loop approval queue management. Displays pending approval steps with workflow context, policy triggers, and matched policies. Supports approve/reject with mandatory justification, expandable detail panels with step input inspection, and real-time badge count polling in navigation. Migration `058_approval_justification.sql` adds `approval_comment` column to `workflow_steps`.
- **Enterprise portal documentation**: Added enterprise docs for Execution Timeline and Approval Dashboard. Fixed OpenAPI spec paths and added `minLength` constraints on approval comment/reason fields.

---

## [5.0.0] - 2026-03-09

### Community

#### Breaking Changes

- **Removed `total_steps` from `CreateWorkflowRequest` API**: The field was deprecated since Platform v4.5.0. Total steps are now exclusively auto-computed when the workflow reaches a terminal state (completed, aborted, or failed). Clients sending `total_steps` in create requests will have the field silently ignored. The `total_steps` field remains in `WorkflowStatusResponse`.
- **MCP `operation` default changed from `"query"` to `"execute"`**: `mcpCheckInputHandler` now defaults to `"execute"` when no `operation` is specified. Callers relying on the implicit `"query"` default must now pass `operation: "query"` explicitly.

#### Added

- **Python SDK: MCP Tool Interceptor**: New `mcp_tool_interceptor()` factory method on `AxonFlowLangGraphAdapter` for enforcing AxonFlow input/output policies around MCP tool calls in LangGraph agents. Includes `MCPInterceptorOptions` configuration and JSON serialization fix.
- **Python LangGraph MCP Interceptor Example**: New example demonstrating MCP input/output policy checks integrated into a LangGraph agent with tool interception

#### Fixed

- Community sync workflow: include `docs/tutorials/` in sync using include-before-exclude rsync pattern
- Community sync workflow: fixed commit detection to use merged PRs instead of workflow runs, fixed pathspec with positive `.` anchor
- Community sync workflow: fixed jq parse error, split detection step permissions, added GH_TOKEN to sync step
- Restored historical version annotations incorrectly bumped in docs sweep

### Enterprise

#### Fixed

- Customer portal UI: removed vulnerable `@tootallnate/once` dependency

### Note

This major version also formally acknowledges a breaking change shipped in a prior minor release:
- `MediaAnalysisResult.extractedText` replaced by `hasExtractedText` + `extractedTextLength` (v4.4.0)

---

## [4.8.0] - 2026-03-03

### Community

#### Added

- **External Trace ID for Workflows**: Add optional `trace_id` field to workflows for correlation with external tracing systems (Langsmith, Datadog, OpenTelemetry)
 - `trace_id` on `CreateWorkflowRequest` and `CreateWorkflowResponse`
 - `trace_id` on `WorkflowStatusResponse` and `GET /workflows` query parameter
 - Partial index on `trace_id` column for query performance (NULL values not indexed)
 - Migration 055: `ALTER TABLE workflows ADD COLUMN trace_id VARCHAR(255)`
- **Per-Tool Governance (Phase 1)**: Add `ToolContext` to step gate requests for tool-aware policy evaluation within tool_call steps
 - New `ToolContext` struct: `tool_name`, `tool_type` (function/mcp/api), `tool_input`
 - Policy adapter propagates tool context into policy evaluation (tool_name, tool_type, tool_input.* keys)
 - Optional field — fully backward compatible with existing SDKs
 - Phase 1 (context enrichment) and Phase 2 (tool-scoped policies, future)
- **Per-Tool Governance Example**: New `langgraph_tools_example.py` demonstrating `check_tool_gate()` and `tool_completed()` for individual tool invocations within a LangGraph tools node
- **SDK-Platform Version Discovery**: Health endpoints now report real platform version, capability registry, and SDK compatibility information
 - `/health` response includes `version` (from `AXONFLOW_VERSION` env var), `capabilities` array, and `sdk_compatibility` object
 - Capability registry lists all platform features with the version that introduced them (15 capabilities from v1.0.0 through v4.8.0)
 - `sdk_compatibility` reports `min_sdk_version` and `recommended_sdk_version` for programmatic upgrade guidance
 - Applies to both Agent and Orchestrator health endpoints
- **Version Check Examples**: New `examples/version-check/` with HTTP, Go, Python, TypeScript, and Java variants demonstrating capability discovery
- **Compatibility Matrix**: New `docs/COMPATIBILITY_MATRIX.md` mapping platform versions to minimum SDK versions
- **SDK Telemetry Documentation**: New `docs/TELEMETRY.md` and `docs/TELEMETRY_CONTRACT.md` describing what SDK telemetry collects (version, OS, architecture), what is never collected (prompts, payloads, PII, API keys), defaults by deployment mode, and opt-out methods (`AXONFLOW_TELEMETRY=off` or `DO_NOT_TRACK=1`)

#### Changed

- **WCP Examples Updated**: All 6 existing workflow-control examples (Go, Python, Python LangGraph, TypeScript, Java, HTTP) updated with trace_id support and verification assertions

#### Fixed

- **Hardcoded health endpoint versions**: Agent and Orchestrator `/health` previously returned `"1.0.0"` regardless of actual platform version
- **Dockerfile version labels**: Agent and Orchestrator Dockerfiles now use `AXONFLOW_VERSION` build arg with `ENV` propagation for runtime access

### Enterprise

#### Added

- **SDK Telemetry Checkpoint Service**: New Lambda service at `checkpoint.getaxonflow.com` for anonymous SDK runtime telemetry
 - `POST /v1/ping` receives SDK telemetry, stores in DynamoDB, returns latest version info
 - `GET /v1/version` returns latest SDK versions (cacheable)
 - Privacy-preserving: IPs hashed (SHA256), 90-day TTL, no PII stored
 - Terraform infrastructure: Lambda, API Gateway, DynamoDB, CloudWatch alarms
- **Per-Tool Governance Policy Adapter**: `wcp_policy_adapter.go` propagates `ToolContext` fields into the dynamic policy evaluation context, enabling tool-aware governance rules
- **Evaluation Tier Feature Unlock**: Three high-impact features unlocked for Evaluation license holders, giving evaluators immediate demo value for governance control, safety simulation, and compliance proof
 - **HITL Approval Gates**: `require_approval` policy action now routes to a real HITL queue with Evaluation+ licenses. Approve/reject API, max 100 pending approvals, 24h fixed expiry with auto-reject, expiry cleanup goroutine
 - **Policy Simulation + Impact Report**: Two new endpoints for dry-run policy evaluation
 - `POST /api/v1/policies/simulate`: Run all active policies against input (Evaluation: 300/day, Enterprise: unlimited)
 - `POST /api/v1/policies/impact-report`: Test a single policy against N inputs with aggregate stats (Evaluation: 50 inputs, Enterprise: 100)
 - **Evidence Export Pack**: Bundled JSON export of audit logs, workflow steps, and HITL approvals
 - `POST /api/v1/evidence/export`: Synchronous JSON export with date range and type filters (Evaluation: 5K records, 14-day window, 3/day; Enterprise: unlimited, no watermark)
 - `GET /api/v1/evidence/summary`: Counts by evidence type within the tier's lookback window
 - Evaluation exports include `"NOT FOR REGULATORY SUBMISSION"` watermark; Enterprise exports are clean
 - Updated `TierLimits` struct with 9 new fields for feature gating
 - Updated `LicenseChecker` interface with 9 new methods
 - MaxPendingApprovals for Evaluation tier raised from 25 → 100
 - Database migration 056: `evidence_exports` table for export tracking and rate limiting
 - OpenAPI spec updated with 4 new endpoint definitions

---

## [4.7.0] - 2026-02-28

### Community

#### Added

- **Standalone MCP Policy-Check Endpoints**: Two new endpoints for external orchestrators (LangGraph, CrewAI) to validate MCP requests and responses against AxonFlow policies without executing connector queries
 - `POST /api/v1/mcp/check-input`: Validate SQL/commands against input policies (SQLi detection, dangerous query blocking, PII in queries, dynamic policies). Returns `allowed: true` or `403` with `block_reason`
 - `POST /api/v1/mcp/check-output`: Validate response data against output policies (PII redaction, exfiltration limits, dynamic policies). Returns original or redacted data with `policy_info`
 - Supports both query-style (`response_data`) and execute-style (`message` + `metadata`) output validation
 - Full audit logging for both endpoints
 - 1033-line test suite covering both endpoints with edge cases
- **MCP Check Endpoint Examples**: Full examples in 6 language variants — HTTP curl scripts, Python SDK, Python-HTTP (raw requests), Go SDK, TypeScript SDK, Java SDK
- **OpenAPI Spec for MCP Check Endpoints**: 4 new schemas (`MCPCheckInputRequest`, `MCPCheckInputResponse`, `MCPCheckOutputRequest`, `MCPCheckOutputResponse`) added to `agent-api.yaml`

#### Fixed

- **Python-HTTP MCP check example**: Added standalone `python-http/` variant with `requirements.txt` and virtual environment setup; refactored Python SDK example for clarity

#### Security

- **CVE-2026-24051**: Bumped `go.opentelemetry.io/otel/sdk` v1.38.0 → v1.40.0 in platform module (HIGH — OTel SDK resource attribute injection)
- **GHSA-72hv-8253-57qq**: Overrode transitive `jackson-core` 2.17.0 → 2.18.6 across 69 Java example pom.xml files (HIGH — async JSON parser `maxNumberLength` bypass)
- **OpenTelemetry BOM**: Added `opentelemetry-bom` dependency management to all Java examples for transitive CVE remediation

### Enterprise

#### Added

- **Circuit Breaker Pipeline Wiring** (#1176, Phase 1): Wire existing circuit breaker state machine into the Agent request pipeline — previously `Check()`, `RecordError()`, `RecordPolicyViolation()` were dead code
 - `CB.Check()` runs before policy evaluation in both `clientRequestHandler` and `handlePolicyPreCheck` — returns HTTP 503 with dynamic `Retry-After` header when circuit is open
 - `RecordPolicyViolation()` called on every policy block, tracking violations toward auto-trip threshold (default: 20 violations in 5 minutes)
 - Active circuits loaded from DB on startup for restart persistence; background goroutine expires circuits every minute for auto-recovery
 - Community stubs added (`Check`, `IsAllowed`, `RecordError`, `RecordPolicyViolation`, `LoadCircuits`, `ExpireCircuits`) — no-op, always allowed
 - Example README updated with correct endpoint names and auto-trip documentation; shell script updated with auto-trip demonstration

---

## [4.6.0] - 2026-02-26

### Community

#### Fixed

- **Open-ended WCP workflows require hardcoded `total_steps`**: `total_steps` is now optional in `CreateWorkflow`. Omitting it (or passing `null`) creates an open-ended workflow — the step count is finalised automatically to `current_step_index` when the workflow reaches any terminal state (completed, aborted, or failed). Fixes LangGraph adapter use case where the graph iterates an unknown number of times. LangGraph example updated to omit `total_steps`; OpenAPI spec and guide updated

### Enterprise

#### Added

- **Cloud Storage Backends for Audit Exports**: S3, Azure Blob Storage, and GCS implementations of `StorageBackend` for durable, compliance-grade audit log export storage
 - S3: SSE-KMS encryption, Object Lock (WORM compliance), presigned URL downloads, configurable retention
 - Azure Blob Storage: SAS URL generation, shared key and connection string authentication
 - GCS: Signed URL generation, ADC / credentials file / credentials JSON authentication
 - Factory constructor: `AUDIT_EXPORT_STORAGE_TYPE` env var selects backend (`s3` | `azure` | `gcs` | `local`)
 - MinIO integration: Docker Compose enterprise config with MinIO for local S3-compatible testing
- **RBI Audit Export to Cloud Storage**: `AuditExportService` uploads exports to configured cloud backend, generates presigned download URLs on-demand, and manages cloud lifecycle (delete, cleanup expired). New `download_url`, `storage_type`, `storage_key` columns on `rbi_audit_exports`. Download handler returns HTTP 307 redirect for cloud exports. Falls back to local filesystem when no backend configured
- **SEBI Audit Export to Cloud Storage**: Large exports (>1000 records) automatically uploaded to cloud storage with presigned URL population. Small exports retain inline data response
- **EU AI Act Export to Cloud Storage**: `ExportService` wired with `StorageBackend` for cloud uploads during async export processing. Download handler generates presigned URLs for cloud-stored exports. New `download_url`, `storage_type`, `storage_key` columns on `euaiact_exports`
- **RBI Module Consolidation**: RBI module merged into `ee/` Go module — removed separate `go.mod`/`go.sum`, aligning with SEBI/EUAIACT/MASFEAT which already share the `ee/` module
- **Compliance Examples**: `audit-export-cloud/` examples (HTTP, Go, Python, TypeScript, Java) demonstrating full round-trip cloud export with presigned URL download and checksum verification

#### Fixed

- **India PII detector test failures**: 5 pre-existing test expectations corrected — UPI positive indicator precedence, sequential bank account rejection, Verhoeff all-zeros checksum, short bank account masking, `extractContext` boundary calculation

---

## [4.5.0] - 2026-02-22

### Community

#### Added

- **Media Governance Policy Engine**: Tiered media governance with system-managed policies
 - 5 default media governance rules seeded automatically: NSFW blocking, violence warning, biometric audit, PII blocking, sensitive document detection
 - Media governance enable/disable: Community deployments opt-in via `MEDIA_GOVERNANCE_ENABLED=true` environment variable
 - Media governance status API: `GET /api/v1/media-governance/status` returns feature availability per tier
 - Media policy categories: `media-safety`, `media-biometric`, `media-pii`, `media-document`
 - System media policy toggle: All tiers can enable/disable system media policies
 - New examples: `media-governance-policies/` demonstrating policy CRUD and governance outcomes (HTTP, Go, Python, TypeScript, Java)
- **Per-Step Token Tracking**: `tokens_in`/`tokens_out` fields through the full WCP step execution pipeline — types, migration 051, repository, service, and all 3 tracker mapping paths
- **Per-Step Cost Tracking**: `cost_usd` field through the full WCP step execution pipeline — types, migration 052, repository, service, and tracker. MAP workflows already had cost tracking; WCP now has parity
- **MAP/WCP Step Result Sync**: `SyncStepResults()` syncs step-level data (status, provider, model, tokens, cost) from `WorkflowExecution` to the unified execution tracker. Called from `executePlanHandler` before `SyncPlanStatus` in all 3 code paths
- **Prompt-Aware Cost Estimation**: `EstimatePlanCost` now uses actual step prompt length (`len(prompt)/4 + 50` input tokens) and `max_tokens` for output estimates, instead of hardcoded 1000/500. Output schema overhead calculated via `json.Marshal`. 5 new unit tests added
- **Stale Model ID CI Guardrail**: CI workflow scans docs and technical-docs markdown files on PRs for deprecated LLM model IDs. Fails CI when stale Anthropic, OpenAI, Ollama, or Bedrock model identifiers are introduced. Hardened with `fetch-depth: 0`, `rg` availability check, and runtime error handling

#### Fixed

- **StepComplete ignores post-execution metrics**: `MarkStepCompleted` handler silently dropped request body — `tokens_in`, `tokens_out`, `cost_usd` were only set at gate time, never updated at completion. Now accepts `StepCompleteRequest` with actual post-execution values that override gate-time estimates via COALESCE. Also stores `step_output` (migration 054). All 4 SDKs updated on v3.6.0 branches
- **Execution viewer token/cost rendering**: Token display showed "undefined" when value was `0` (used `!= null` check and `?? 0` nullish coalescing). Cost display skipped legitimate `$0.0000` values. Policy events rendered blank rows due to type mismatch between `[]string` and expected objects
- **WCP gate decisions invisible in unified execution**: `Decision`, `DecisionReason`, `PoliciesMatched`, `ApprovalStatus`, `ApprovedBy` were never mapped into unified `StepStatus`. Added conversion helpers: `extractPolicyNames`, `mapWCPGateDecision`, `mapWCPApprovalStatus`
- **Step status clobbering**: `BaseExecutionTracker.AddStep` unconditionally overwrote step status to `pending`, discarding WCP-computed status. Now preserves pre-set status
- **Execution cost null in API**: `actual_cost_usd` always null in API responses. Added `TotalCost()` calculation in `resolveExecution` and `ListExecutions`
- **WCP steps stuck at "running"**: Steps remained in running state when workflow completed. Replaced O(n) `ListExecutions` scan with O(1) indexed `GetByMetadata` lookup
- **Cost estimation used hardcoded tokens**: `EstimatePlanCost` ignored `Prompt` and `MaxTokens` fields on `WorkflowStep`, always using 1000/500. All 5 cost-estimation examples sent non-existent `estimated_tokens_in`/`estimated_tokens_out` fields silently dropped by JSON unmarshaling

#### Changed

- **LLM Model ID Sweep**: ~200 files updated across code defaults, pricing tables, tests, examples, infrastructure, and technical docs. Migration 053 updates COALESCE default for Bedrock model in `llm_provider_configs`
 - Anthropic: `claude-3-*`/`claude-3-5-*` → `claude-opus-4-20250514`/`claude-sonnet-4-20250514`/`claude-haiku-4-5-20251001`
 - Bedrock: Updated to region-prefixed inference profile IDs (`us.anthropic.claude-sonnet-4-20250514-v1:0` etc.)
 - OpenAI: `gpt-3.5-turbo` → `gpt-4o-mini`, `gpt-4-turbo` → `gpt-4o`
 - Ollama: `llama3.1` → `llama3.2`, `codellama` → `qwen2.5-coder:32b`, `mistral:7b` → `mistral:latest`, `mixtral:8x7b` → `mixtral:latest`
- **LLM provider diversity in examples**: 20 WCP and HITL example files updated from hardcoded `openai/gpt-4` to a mix of providers (ollama, anthropic, gemini, bedrock, azure) demonstrating provider-agnostic governance
- **Execution viewer UI**: Wired to unified execution API (`/api/v1/unified/executions`) with correct field mappings, gate decision/approval display, and step_index handling
- Media governance disabled by default on Community tier — previously ran globally if analyzers were registered
- Dynamic policy API (`/api/v1/dynamic-policies`) now accepts `media-*` category prefixes alongside `dynamic-*`
- Dynamic policy listing now includes system/global policies alongside tenant policies
- Documentation: All LLM model references updated to current versions across docs and technical-docs
- SDK version references bumped to v3.5.0
- Docker base images: Go 1.25-alpine → 1.26-alpine for agent and orchestrator
- CI dependencies: `actions/github-script` 7→8, `docker/build-push-action` 5→6, `actions/upload-artifact` 4→6, `aws-actions/configure-aws-credentials` 4→6, `actions/download-artifact` 4→7 (#1197-#1201)

### Enterprise

#### Added

- **Per-Tenant Media Governance Configuration**: `GET/PUT /api/v1/media-governance/config` for enable/disable and analyzer restriction per tenant
- **System Media Policy Modification**: Enterprise tier can modify actions and priority on system media policies
- **Media Governance Audit Export**: `GET /api/v1/media-governance/audit/export` for compliance reporting (CSV/JSON)

#### Fixed

- **Customer portal Docker build failure**: `go.mod` in `ee/platform/customer-portal/` pinned `golang.org/x/crypto v0.45.0` while platform bumped to `v0.47.0` during v4.4.0 merge

### Breaking

- Community deployments that previously had media governance running globally must now set `MEDIA_GOVERNANCE_ENABLED=true` to opt back in

---

## [4.4.0] - 2026-02-18

### Community

#### Added

- **Multimodal Image Governance Pipeline**: Images are governed the same way as prompts — analyzed before routing, policies can block, and everything is audited.
 - `platform/orchestrator/media/` package: registry, factory, pipeline, audit, cost tracking, and license gating
 - Pluggable `MediaAnalyzer` interface with Name(), Type(), Analyze(), HealthCheck(), Capabilities()
 - Local OCR analyzer via Tesseract (`exec.CommandContext`, stdin/stdout, no temp files)
 - PII detection via composition — OCR text feeds existing `PIIDetectorFunc`, no drift
 - Pipeline runs analyzers in parallel per image, aggregates worst-case signals
 - Community default: fail-open (warn and audit), never blocks
 - 11 policy fields: `media.has_pii`, `media.has_faces`, `media.nsfw_score`, `media.violence_score`, `media.content_safe`, `media.has_biometric_data`, `media.is_sensitive_document`, `media.document_type`, `media.face_count`, `media.has_extracted_text`, `media.extracted_text_length`
 - API: `media` array on request, `media_analysis` object on response with per-image results
 - SHA-256 hashing for base64 and URL-sourced images (URL download with 30s timeout, 20MB limit, cached)
 - Validation: MIME type allowlist, max 20MB per image, max 8192px per dimension, max 10 images per request
 - Audit logging: hash, MIME type, file size, PII detection, content safety, timing (Enterprise adds biometric, safety scores, per-analyzer details)
 - New examples in 5 languages (HTTP/curl, Go, Python, TypeScript, Java) with strict field validation
- **SDK Media Types**: All 4 SDKs updated with `MediaContent`, `MediaAnalysisResult`, `MediaAnalysisResponse`
 - Go: `ProxyLLMCallWithMedia()` method
 - Python: `proxy_llm_call_with_media()` async + sync, caching disabled for media requests
 - TypeScript: media support in `proxyLLMCall()` options
 - Java: media in `ClientRequest.Builder`

### Enterprise

#### Added

- **Cloud Media Analyzers** (build tag `enterprise`): AWS Rekognition, Google Cloud Vision, Azure Computer Vision
- **Biometric and NSFW detection**: Face detection with count, NSFW and violence scoring, biometric data detection
- **Document classification**: Sensitive document detection (tax forms, medical records, bank statements, etc.)
- **Rich audit fields**: Per-analyzer details, biometric data, safety scores, document classification (gated behind `isEnterprise`)
- **Fail-closed enforcement**: Configurable to block requests when media analysis fails (Enterprise only)

#### Changed (Hardening)

- **Structured warning codes**: All media warnings now include a `code` + `message` (e.g., `WarnMediaAnalyzerError`). Both `warnings` (string array, backward-compatible) and `structured_warnings` (code/message objects) are returned in API responses.
- **Pre-decode base64 size check**: Oversized base64 payloads rejected before decode (avoids memory allocation).
- **Base64 decoded bytes cache**: Decoded bytes from `Validate()` are reused by `ComputeSHA256()` and `GetRawData()`, eliminating redundant base64 decoding.
- **Decompression bomb guard**: Images exceeding 100M pixels are rejected via `image.DecodeConfig` header check (fail-open for unparseable formats). New error code `ErrMediaDecompressionBomb`.
- **Analyzer concurrency cap**: Default max 10 concurrent analyzers per image via semaphore (configurable via `WithMaxConcurrentAnalyzers`).
- **Context cancellation**: Pipeline respects `ctx.Done()` during result collection; fail-open returns partial results with `WarnMediaPartialResults`, fail-closed returns error.
- **Deterministic analyzer result ordering**: `AnalyzerResults` sorted by `AnalyzerName`.
- **Fail-closed when no analyzers**: If enforcement is fail-closed and no analyzers are registered, pipeline returns error instead of empty results.
- **Orchestrator fail-closed handler**: When media analysis fails in fail-closed mode, orchestrator responds `403 Forbidden`.
- **Audit redaction**: Enterprise audit records redact `ExtractedText` to `[redacted: N chars]` and `PIIFinding.Value` to `[redacted]`.
- **SDK cache skip for media**: Go and Java SDKs skip response caching when media is present (binary content makes cache keys unreliable).

#### Breaking

- **`extracted_text` removed from API responses and policy context.** Replaced by `has_extracted_text` (bool) and `extracted_text_length` (int). Existing policies referencing `media.extracted_text` must be updated to use `media.has_extracted_text` or `media.extracted_text_length`.

---

## [4.3.1] - 2026-02-16

### Community

#### Fixed

- **Execution cost always $0.0000**: `recordStepSnapshot()` now calculates actual cost from tokens using pricing config instead of leaving `CostUSD` as zero. Costs visible in Execution Viewer UI and API responses
- **Router cost used pre-execution estimates**: LLM router now uses actual response token counts for cost calculation instead of pre-execution estimates, with fallback for providers that only report total tokens

---

## [4.3.0] - 2026-02-13

### Community

#### Fixed

- **WCP error sentinel consistency (Bugs A, I)**: All repository methods (`CompleteWorkflow`, `AbortWorkflow`, `FailWorkflow`, `ResumeWorkflow`) now wrap `ErrWorkflowNotFound` with `%w` instead of creating new errors. `errors.Is(err, ErrWorkflowNotFound)` works correctly across all WCP operations. Added missing `rows.Err()` checks in `List()`, `GetStepsForWorkflow()`, `GetPendingApprovals()`.
- **MAP execution tracking accuracy (Bugs C, D)**: `SyncPlanStatus` replaced O(n) `ListExecutions` scan with direct `GetExecutionByPlanID()` lookup using new GIN index on `metadata->>'plan_id'`. Expired plans now tracked as `expired` status instead of incorrectly mapping to `completed`.
- **StepModeEvaluator idempotency (Bug J)**: Step gate evaluation keyed on `(planID, stepIndex)` via `sync.Map` instead of a plain counter. Retries return the cached decision instead of advancing the counter.
- **Connection tracker tenant validation (Bug K)**: SSE connections with missing `X-Tenant-ID` header now return `400 Bad Request` instead of silently falling back to a shared `"default"` bucket.
- **SyncPlanStatus error visibility (Bug L)**: `SyncPlanStatus` errors logged as warnings instead of silently discarded via `_ =`.
- **json.Marshal error handling (Bug B)**: Abort and fail reason marshaling errors in WCP repository now propagated instead of suppressed with `_:=`.

#### Added

- **Cost Estimation Endpoints**: Pre-execution cost analysis for MAP plans
 - `POST /api/v1/plans/estimate`: Estimate cost from provider/model/steps specification
 - `GET /api/v1/plans/{id}/cost`: Get cost estimate for an existing plan
 - Tiered response: community gets aggregate total only (10/day), evaluation gets per-step breakdown (100/day), enterprise unlimited
- **WCP Community Approve/Reject**: Basic approval flow via step gates with HITL status endpoint (`GET /api/v1/hitl/status`)
 - Tiered limits: community max 5 pending approvals, evaluation max 25, enterprise unlimited
- **Direct Metadata Lookup**: `GetExecutionByPlanID()` and `GetExecutionByMetadata()` methods for efficient execution lookups
- **Expired Execution Status**: `ExecutionStatusExpired` constant and `ExpireExecution()` method for proper lifecycle tracking
- **Migration 050**: GIN index on `execution_history.metadata->>'plan_id'`, `expired` enum value for `execution_status`
- **New examples**: `workflow-fail/`, `cost-estimation/`, `hitl-queue/` across Go, Python, TypeScript, Java, and HTTP

### Enterprise

#### Added

- **MAP-HITL Integration**: Enterprise HITL approval workflow for MAP plan steps
 - `POST /api/v1/plans/{id}/steps/{step_id}/approve` and `reject` endpoints
 - `HITLWorkflowEngine` wired when enterprise license present
 - Community mode returns 403 for HITL endpoints
- **HITL Expiration Background Job**: Automatic expiration of stale approval requests
 - 1-hour ticker interval with configurable schedule
 - `ExpireRequests()` method in service and repository layers
 - Graceful shutdown via stop channel
- **HITL Queue API in SDKs**: All 4 SDKs now include HITL queue methods (list, get, approve, reject, stats)
- **New enterprise examples**: `ee/examples/hitl-queue/`, `ee/examples/hitl-expiration/`, `ee/examples/map-hitl/`, `ee/examples/cost-estimation-enterprise/`, `ee/examples/tier-limits/`

---

## [4.2.2] - 2026-02-12

### Community

#### Fixed

- Unified execution `CancelExecution` and `StreamExecutionStatus` endpoints returned 404 when given a WCP workflow ID or MAP plan ID. Now uses the same multi-strategy resolution as `GetExecutionStatus` (direct ID → WCP tracker → MAP tracker → metadata fallback)
- Execution history FK constraint on `tenant_id` prevented record creation in community mode when SDK sends a default client ID. Dropped FK constraint in favor of RLS policy for tenant isolation (migration 049)

## [4.2.1] - 2026-02-10

### Community

#### Fixed

- `FailWorkflow()` missing webhook notification, audit log, and HTTP endpoint (`POST /api/v1/workflows/{id}/fail`)
- WCP example fixes: TypeScript `PendingApprovalsResponse.items` → `.approvals`, Java `WorkflowStatus` enum-to-string comparison

#### Added

- FailWorkflow test coverage across all 5 WCP examples and 4 webhook unit tests with `MockWebhookNotifier`

---

## [4.2.0] - 2026-02-10

### Community

#### Added

- **Evaluation Tier Licensing**: Free 90-day license with elevated limits for production proof-of-concepts
 - Request at [getaxonflow.com/evaluation-license](https://getaxonflow.com/evaluation-license)
 - Limits: 50 tenant policies, 5 org policies, 5 connectors with custom policies, 3 LLM providers, 14-day audit retention, 100 plans, 25 versions/plan
 - Graceful degradation to Community tier on expiry. No downtime, no data loss
- **Ed25519 License Signing**: Asymmetric cryptographic signatures replace HMAC-SHA256
 - Public keys embedded in binary; private keys stay in infrastructure (AWS Secrets Manager)
 - Format: `AXON-{PAYLOAD}.{SIGNATURE}`. Old V2 (`AXON-V2-.`) and V1 formats rejected with clear upgrade message
 - Two keypairs: evaluation (for free licenses) and enterprise (for paid licenses). Blast radius isolation
- **Feature Limits Boundary Testing**: `examples/feature-limits/http/test_feature_limits.sh` validates all tier limits across Community, Evaluation, and Enterprise modes
- **E2E Setup Script**: `scripts/setup-e2e-testing.sh` now supports `evaluation` mode alongside `community` and `enterprise`
- **Workflow Control Plane v1**: Governance gates for external orchestrators (LangChain, LangGraph, CrewAI)
 - `POST /api/v1/workflows`: Register workflow with name, source, total_steps, metadata
 - `GET /api/v1/workflows`: List workflows with status/source filters
 - `GET /api/v1/workflows/{id}`: Get workflow status and step history
 - `POST /api/v1/workflows/{id}/steps/{step_id}/gate`: Policy-based step gate (allow/block/require_approval)
 - `POST /api/v1/workflows/{id}/steps/{step_id}/complete`: Mark step completed with output data
 - `POST /api/v1/workflows/{id}/complete`: Mark workflow completed
 - `POST /api/v1/workflows/{id}/abort`: Abort workflow with reason
 - `POST /api/v1/workflows/{id}/resume`: Resume after approval
 - Step gate responses include `policies_evaluated` and `policies_matched` for policy transparency
 - Audit logging: `workflow_created`, `workflow_step_gate`, `workflow_completed`, `workflow_aborted`
- **MAP Plan Versioning & Rollback**: Full plan lifecycle management with optimistic locking
 - `UpdatePlan()`: Update plan with version conflict detection (`ErrVersionConflict` on mismatch)
 - `GetPlanVersions()`: Retrieve full version history with change tracking (changed_by, change_type, change_summary)
 - `RollbackPlan()`: Restore to a previous version snapshot (creates pre-rollback snapshot first)
 - `CleanupExpiredPlans()`: Background worker removes expired plans (configurable interval, default 15min)
 - Community limits: max 25 plans with versioning, max 10 versions per plan
 - Migration `047_plan_versioning.sql`: adds `version` column to plans, creates `plan_versions` table
- **MAP Confirm & Step Execution Modes**: HITL execution modes via WCP infrastructure
 - Confirm mode: every step requires explicit approval before proceeding
 - Step mode: first step auto-allowed, subsequent steps require approval
 - Creates WCP workflow (`map-confirm-{planID}` / `map-step-{planID}`) to track step gates
 - Maps plan steps to WCP step types (llm-call, tool-call, connector-call, etc.)
- **MAP Plan Cancellation**: `PlanStatusCancelled` constant and `CancelPlan()` method in planning service
- **Unified Execution Tracking**: Consistent status tracking across MAP plans and WCP workflows
 - `GET /api/v1/unified/executions`: List executions with type/status filters
 - `GET /api/v1/unified/executions/{id}`: Get status by execution ID, workflow ID, or plan ID
 - `POST /api/v1/unified/executions/{id}/cancel`: Cancel execution (propagates to MAP or WCP)
 - MAPExecutionTracker: adapts planning service to unified format, syncs plan state changes
 - WCPExecutionTracker: adapts WCP service to unified format, maps step decisions to unified status
 - Lookup by execution ID, `wf_*`/`wcp_*` prefix, `plan_*` prefix, or metadata search
- **SSE Execution Streaming**: `GET /api/v1/unified/executions/{id}/stream` provides real-time execution events
 - Events: `execution.started`, `execution.completed`, `execution.failed`, `execution.cancelled`, `step.started`, `step.completed`, `step.failed`, `step.decision`
 - Auto-closes on terminal state; no external dependencies (pure Go channels)
 - Per-tenant connection limits: Community (5), Evaluation (25), Enterprise (unlimited)
 - HTTP 429 with `Retry-After: 30` header when limit exceeded
 - `ConnectionTracker` with atomic acquire/release pattern (handles disconnect, timeout, panic)
- **EventHub Pub-Sub**: Channel-based event bus in `platform/shared/execution/event_hub.go`
 - Buffered channels (cap 16), non-blocking publish with slow subscriber protection
 - Both MAP and WCP trackers publish events on state transitions
- **Unified Execution Handler Tests**: Tests covering list, get, cancel, CORS, and route registration
- **CancelPlan Tests**: 6 tests covering cancel from pending/executing states, validation
- **Cost Estimation**: `GET /api/v1/plans/{id}/cost` and `POST /api/v1/plans/estimate` for pre-execution cost estimation with per-step breakdowns
- **MAP + WCP Examples**: `map-confirm-mode/`, `map-lifecycle/`, `workflow-control/` across all 5 languages (Go, Python, TypeScript, Java, HTTP)

#### Fixed

- **Tenant ownership check on unified execution endpoints**: Execution list/get/cancel now validates tenant ownership, preventing cross-tenant data access
- **Agent gateway always returned `success: true`**: Orchestrator errors (409 cancelled, 410 expired, 403 blocked) were buried in nested response data. Agent never propagated them to `ClientResponse`. SDKs never raised exceptions for failed operations. Also fixed metrics counting errors as successes and usage recorder status codes.
- **MAP confirm mode not enforced**: `ConfirmModeEvaluator` was defined but never wired into WCP `StepGate()`. Policy engine always returned "allow" instead of "require_approval". Fixed by adding `GateOverride` to `StepGateRequest`, used by `ExecuteWithConfirm` and `resumePlanHandler`.
- **MAP execution timeout too tight**: Hardcoded 60s timeout caused `context deadline exceeded` on multi-step balanced mode plans. Now scales to 30s per step with 60s minimum floor.
- **Examples hardcoded user tokens**: All examples now read `AXONFLOW_USER_TOKEN` env var with safe community defaults
- **25 broken documentation links**: Replaced stale `docs.getaxonflow.com` URLs across 15 markdown files
- **Down migrations 045/046 destructive**: Replaced destructive Down sections with no-ops to prevent CI `psql -f` from reversing Up migrations

#### Changed

- **License format migration**: All licenses must use Ed25519 format (`AXON-{PAYLOAD}.{SIGNATURE}`). Old V2 HMAC format (`AXON-V2-.`) returns Community tier with upgrade guidance. No action needed for users without a license (Community mode unchanged).
- **HMAC startup check removed**: `ValidateHMACSecretAtStartup()` is now a no-op. No HMAC secret environment variable required at startup
- **BaseExecutionTracker**: Now publishes events via EventHub after every state change (start, complete, fail, cancel, step transitions)
- **UnifiedExecutionHandler**: Accepts EventHub and PlanService; registers cancel, stream, and list/get routes
- **Updated with SSE streaming, cancellation, and versioning architecture patterns
- **License tier names normalized**: `PRO`→`Professional`, `ENT`→`Enterprise`, `PLUS`→`Plus`, `BASIC`/`EVALUATION`→`Evaluation`. Migration 122 updates all tier-related tables. DB constraint enforces canonical names.
- **SDK versions bumped to v3.3.0** across all examples and docs
- **CI dependencies bumped**: actions/checkout v6, actions/setup-go v6, Go 1.25, Docker Alpine 3.23
- **Coverage thresholds raised to 76%** for orchestrator and connectors modules
- **Documentation quality improved** across 36 files: correct auth patterns, SDK method names, "source-available" terminology, current versions

### Enterprise

#### Added

- **WCP HITL Approval Gates**: Human-in-the-loop approval for workflow steps
 - `POST /api/v1/workflows/{id}/steps/{step_id}/approve`: Approve a pending step (requires approval_id from gate)
 - `POST /api/v1/workflows/{id}/steps/{step_id}/reject`: Reject step with optional reason
 - `GET /api/v1/workflows/approvals/pending`: List all workflows awaiting human approval
 - Approval URLs generated for notification links
- **Webhook Notification System**: Event-driven notifications for workflow and approval events
 - `POST /api/v1/webhooks`: Create webhook subscription
 - `GET /api/v1/webhooks`: List subscriptions
 - `GET /api/v1/webhooks/{id}`: Get subscription details
 - `PUT /api/v1/webhooks/{id}`: Update subscription
 - `DELETE /api/v1/webhooks/{id}`: Delete subscription
 - 7 event types: `step.approval_required`, `step.approved`, `step.rejected`, `step.completed`, `workflow.completed`, `workflow.aborted`, `workflow.failed`
 - HMAC-SHA256 request signing when secret configured; secret never exposed in API responses
 - SSRF protection: blocks private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8)
 - Retry strategy: exponential backoff (1s, 2s, 4s), max 3 retries, 10s timeout per attempt
 - Migration `048_webhook_subscriptions.sql`: subscription and delivery tracking tables

---

## [4.1.0] - 2026-02-05

### Community

#### Added

- **AES-256-GCM Connector Credential Encryption**: Credentials encrypted at rest via `CONNECTOR_ENCRYPTION_KEY` env var
 - Credentials stored separately from connection URLs. No secrets in `connection_url` column
 - Supports encrypted, JSON-quoted encrypted, and plain JSON formats (backward compatible)
- **Connector SDK Runtime Wiring**: Connector installs persist to `connector_configs` table; Agent reads runtime configs from DB with static fallback
 - All SDK-backed connectors (Postgres, MySQL, MongoDB, Redis, Cassandra, HTTP) migrated to `connectors/sdk.BaseConnector`
 - Runtime config service loads connector credentials and options from DB, reconstructs connection URLs at runtime
- **LLM Provider SDK Registration**: SDK-backed LLM providers (OpenAI, Anthropic, Gemini) registered at orchestrator startup via factory pattern
 - Azure OpenAI runtime config parity across env/config/DB paths
- **Strict Provider Pinning**: `context.strict_provider=true` hard-pins to a specific provider; default remains preference with failover
- **Direct LLM Config Passing**: `BootstrapFromConfig` replaces goroutine-unsafe `ApplyLLMConfigToEnv` / `os.Setenv`
- **Atomic LLM Provider Update**: `Registry.Update()` method prevents gap where provider is missing during reconfiguration
- **Audit Logging Examples**: Complete audit logging examples across Go, Python, TypeScript, Java SDKs
- **Testcontainers for Integration Tests**: PostgreSQL integration tests use testcontainers instead of mock DB
- **Runtime Connector Config Migrations**: `007_runtime_connector_configuration.sql`, `045_connector_configs_credentials.sql`

#### Fixed

- **Encrypted credentials never decrypted on load**: `RuntimeConfigService` now uses `CredentialEncryptor.Decrypt()` instead of `json.Unmarshal`
- **MySQL DSN credentials persisted in stored URLs**: `StripURLCredentials` now handles `@tcp()` and `@unix()` DSN formats
- **Connector uninstall DB/registry divergence**: Unregister from memory first, then delete DB record
- **PII detection examples require `PII_ACTION=block`**: Updated examples and docs with prerequisite
- **Migration runner safety**: `_down.sql` files skipped by migration runner to prevent accidental rollbacks
- **Internal MCP calls carry tenant ID**: Orchestrator→Agent MCP calls now include tenant ID for correct access isolation

#### Changed

- **Connector install/uninstall requires `tenant_id`** when a DB is present: Prevents silent inconsistent state; matches schema constraints
- **`context.provider` remains preference**: Failover still default unless `strict_provider` is set
- **LLM provider runtime constraints**: Expanded allowed provider names to include `gemini`, `azure-openai`, and `custom`
- **Connector runtime constraints**: Expanded allowed connector types to include SDK-backed connectors (http/mysql/mongodb/redis/s3/etc)
- **SDK versions bumped to v3.2.0** across all examples and docs
- **README**: Design Partner program CTA, Feedback Week, LLM provider scope clarification

### Enterprise

#### Added

- **Enterprise runtime config bootstrap**: Ensures runtime connector/LLM config tables are created after `customers` exists
- **Bedrock example hardening**: Enterprise Bedrock example now uses standard env aliases + enterprise JWT for policy pre-checks

## [4.0.0] - 2026-02-03

### Community

#### Added

- **Configurable System Policy Architecture**: Per-mode policy control for MCP and Gateway modes
 - `MCP_STATIC_POLICIES_ENABLED` / `GATEWAY_STATIC_POLICIES_ENABLED`: enable/disable static policies per mode
 - `MCP_PII_ACTION` / `GATEWAY_PII_ACTION`: override PII action per mode (block/redact/warn/log)
 - `MCP_SQLI_ACTION` / `GATEWAY_SQLI_ACTION`: override SQLi action per mode
 - `MCP_STATIC_POLICIES_SKIP_CATEGORIES` / `GATEWAY_STATIC_POLICIES_SKIP_CATEGORIES`: skip specific categories
 - Env var precedence: mode-specific → global (`PII_ACTION`) → engine defaults
- **Policy Engine Consolidation**: Single evaluation path across all modes
 - Proxy, Gateway, and MCP all use `UnifiedPolicyEngine` as primary path (was three separate engines)
 - Standalone `AuditManager` decoupled from `DatabasePolicyEngine`; shared engine now receives audit adapter
 - Admin role handling via `SkipCategories` instead of engine-level role checks
- **MCP Execute Policy Responses**: `policy_info`, `redacted`, `redacted_fields` in MCP execute responses
- **Execution Replay CLI + Embedded Execution Viewer UI**:
 - `axonctl executions list/get/replay/export`: CLI commands for inspecting workflow executions from the terminal
 - Browser-based execution viewer at `/ui/executions/` via Go `embed.FS`. Filterable execution list, step timeline visualization, JSON export
 - Supports both MAP (Multi-Agent Planning) and WCP (Workflow Control Plane) executions
- **HMAC-Signed Internal Service Tokens**: HMAC-SHA256 signed tokens replace plain shared-secret for orchestrator-to-agent auth. 5-minute replay protection. Backward-compatible with deprecation warning.
- **Singapore PII patterns documentation**: SDK feature coverage docs updated with NRIC, FIN, UEN patterns

#### Fixed

- **Gateway pre-check ignoring `GATEWAY_STATIC_POLICIES_ENABLED=false`**: Fell through to `dbPolicyEngine` which didn't check the flag
- **Orchestrator ignoring action overrides**: `processWithSharedEngine()` and `DetectWithSharedEngine()` now respect per-mode config
- **Proxy mode ignoring per-mode policy config**: Now uses `UnifiedPolicyEngine` with `GATEWAY_*` env vars
- **Shared policy engine had nil audit queue**: Policy evaluations in MCP/Gateway now log through audit infrastructure
- **Dockerfile missing `/var/lib/axonflow/audit/`**: Audit queue fallback failed for non-root user
- **Gateway enterprise integration tests**: Fixed OAuth2 Basic auth with valid V2 license format
- **Marketplace connector persistence tests**: Fixed lazy-loaded connectors after `ReloadFromStorage`
- **HITL examples only tested CRUD**: All 4 SDKs now test actual enforcement via `ProxyLLMCall`

#### Changed

- **SDKs v3.0.0**: All four SDKs bumped to v3.0.0 (Python skips v2.0.0 for cross-SDK version consistency):
 - **Removed `executeQuery()`** (deprecated since v2.5): Use `proxyLLMCall()` for proxy mode or MCP connector queries
 - **TypeScript**: Removed 5 deprecated LLM interceptors, added `wasRedacted()` helper
 - **Python**: Skipped v2.0.0 → v3.0.0 for consistency. Added `was_redacted()`, fixed internal MCP call serialization, fixed null `policies_evaluated` validation
 - **Go**: Updated module path to `axonflow-sdk-go/v3`, added `WasRedacted()`
 - **Java**: Removed `executeQuery()`/`executeQueryAsync()`, verified `isRedacted()`
- **Gateway mode examples enhanced**: PII detection (SSN, India PAN, Aadhaar) and SQLi blocking (DROP TABLE, UNION SELECT) assertions added across all 4 SDKs
- **New examples**: `policy-configuration/` and `gateway-policy-config/` (Go, Python, TypeScript, Java)
- **Enhanced examples**: `pii-detection/`, `sqli-detection/`, `mcp-policies/`, `map/` updated with multi-action mode and `policy_info`

#### Breaking Changes

- **`executeQuery()` removed from all SDKs**: Use `proxyLLMCall()` or MCP connector queries. Deprecated since v2.5.
- **Env var behavior change**: Global detection env vars (`PII_ACTION`, `SQLI_ACTION`) now control the primary shared engine. Existing deployments may see different behavior in MCP and Gateway modes. Use mode-specific vars (`MCP_PII_ACTION`, `GATEWAY_PII_ACTION`) for precise control.

---

## [3.6.1] - 2026-01-30

### Community

#### Fixed

- **MCP Community Auth**: MCP query/execute endpoints incorrectly required license validation in community mode, returning HTTP 401
 - Replaced raw environment variable check with canonical `isCommunityMode()` helper
 - Extracted duplicated license validation into shared `validateServiceLicense()` helper
- **MAP Replay Recording**: Parallel execution path was missing replay recording. MAP executions left no trace in `execution_snapshots`
 - Added `StartExecution`, `recordStepSnapshot`, `CompleteExecution`/`FailExecution` calls to parallel path
- **MAP Parallel Data Race**: Input map shared across parallel goroutines without protection
- **MAP Silent Error Swallowing**: `FailExecution` errors silently discarded in 4 call sites
- **EU AI Act Export Data Race**: `CreateExport` returned shared pointer mutated by async goroutine, causing flaky tests under `-race`
- **Anthropic Default Model**: Updated default from `claude-3-5-sonnet-20241022` (404) to `claude-sonnet-4-20250514`

#### Added

- **HTTP Examples**: Added missing HTTP examples for `mcp-connectors` and `map` (completing 30/30 cross-language coverage)

### Enterprise

#### Fixed

- **V1 License Error Messaging**: Renamed error code to `V1_LICENSE_NOT_SUPPORTED`, removed internal tool paths from user-facing errors
- **DEPLOYMENT_MODE Case Handling**: Removed unnecessary case normalization in admin auth middleware

#### Security

- **Next.js** (GHSA-h25m-26qc-wcjf): Bumped in customer-portal-ui (16.0.10→16.1.6) and banking-demo (15.5.9→15.5.10)

---

## [3.6.0] - 2026-01-26

### Community

#### Added

- **Unified Execution Tracking**: Consistent status tracking for MAP plans and WCP workflows
 - New unified execution history table (`execution_history`) for both MAP and WCP executions
 - `GET /api/v1/executions/{id}` - Get unified execution status by ID
 - `GET /api/v1/executions` - List executions with type/status filters
 - `ExecutionType`: `map_plan`, `wcp_workflow`
 - `ExecutionStatusValue`: `pending`, `running`, `completed`, `failed`, `cancelled`, `aborted`, `expired`
 - `StepStatusValue`: `pending`, `running`, `completed`, `failed`, `skipped`, `blocked`, `approval`
 - `UnifiedStepType`: `llm_call`, `tool_call`, `connector_call`, `human_task`, `synthesis`, `action`, `gate`
 - Unified step tracking with duration, cost, and policy decision fields
 - SDK support in Go v2.7.0, Python v1.7.0, TypeScript v2.7.0, Java v2.7.0

- **Singapore PII Detection**: MAS FEAT compliance patterns for PII detection
 - NRIC pattern detection (S/T/M/F/G prefixes) with critical severity
 - FIN pattern detection (F/G prefixes) for foreign identification
 - UEN pattern detection for business entities
 - Singapore phone numbers (+65 format)
 - Singapore postal codes (6-digit)
 - Examples: Go, Python, TypeScript, HTTP

- **Compliance Policy Categories**: New policy category constants for compliance evaluation
 - Added `CategoryComplianceEUAIAct` and `CategoryComplianceMASFEAT` constants
 - Added `IsComplianceCategory()` and `AllComplianceCategories()` helper functions
 - RBI, SEBI, EU AI Act, and MAS FEAT categories evaluated at gateway and MCP handlers

- **Redis Policy Store**: Distributed rate limiting and budget tracking for MCP policies with automatic fallback

- **Budget Enforcement Wiring**: Budget limits now block requests when exceeded
 - Gateway calls `CheckBudget()` before processing requests
 - HTTP 402 returned when budget exceeded with `on_exceed=block`
 - `X-Budget-Warning` header for `on_exceed=warn`
 - `BudgetInfo` in response

- **HITL Workflow Engine Wiring**: Human-in-the-Loop integrated with workflow execution
 - `ExecuteWithHITL()` wired to production execution path
 - Enterprise: Database persistence; Community: In-memory with auto-approve

- **WCP to HITL Connection**: `require_approval` decisions create HITL queue entries

- **MAP Conditional Branch Execution**: Branches now execute steps, not just record intent

- **MAP Parallel Execution Tolerance**: Configurable `SoftFailureTolerance` replaces hardcoded logic

- **Policy Cache Refresh API**: Immediate policy availability after CRUD operations
 - New `PolicyEngineRefresher` interface for policy engines
 - `RefreshPolicies()` method on both `DynamicPolicyEngine` and `DatabaseDynamicPolicyEngine`
 - `PolicyService` triggers refresh after create, update, delete, and import operations
 - Eliminates 30-second cache delay for WCP HITL integration

- **Dynamic Policy `require_approval` Action**: HITL trigger from dynamic policies
 - New `require_approval` action type in dynamic policy evaluation
 - Sets `Allowed=false` and adds `require_approval` to `RequiredActions`
 - Supports `reason` field in action config for approval context

- **Nested Context Path Support**: Enhanced dynamic policy field matching
 - `context.step_input.query` now correctly resolves to `req.Context["step_input.query"]`
 - Supports arbitrary depth in dotted notation (e.g., `context.a.b.c`)

#### Fixed

- **HMAC Secret Panic**: Enterprise Docker images no longer panic when HMAC secret not initialized
 - Added `isHMACSecretInitialized()` thread-safe check using RLock
 - `IsEnterpriseTier()` returns false gracefully instead of panicking
 - Allows enterprise images to run in community mode without configuration changes

- **MCP Dynamic Policy Evaluation**: Fixed multiple pre-existing bugs preventing MCP dynamic policies from working
 - Added MCP policy types to validation, fixed DATABASE_URL propagation, created interface for both in-memory and database engines
- **Agent DB Auth**: Fixed JSON parsing for permissions from JSONB array
- **Cassandra Connector**: Apply timeout from query config to CQL operations

- **SDK Examples with Assertions**: Examples now have proper pass/fail testing and exit with code 1 on failure
 - Added assertions across all 4 SDKs (Go, Python, TypeScript, Java)
 - Community examples fixes: workflow examples, policy examples, integration examples

- **HITL Enforcement for Compliance Frameworks**: Fixed HITL not triggering in Proxy Mode
 - Root cause: Database constraint missing `require_approval` action + runtime wiring gap
 - Migration 044: Added `require_approval` to `action_request`/`action_response` constraints
 - Added `ActionRequireApproval` action type to shared policy types
 - Multi-strategy HITL detection: `eu_ai_act_article_14`, `requires_hitl` + compliance context, high-risk + compliance framework
 - EU AI Act and RBI-SEBI examples now achieve 100% HITL compliance rate

#### Deprecated

- **API: page_size → limit**: Standardized pagination parameter name
 - **Action Required:** Migrate from `page_size` to `limit` before v4.0.0
 - `page_size` query parameter is deprecated and **will be removed in v4.0.0**
 - Affected endpoints: `/api/v1/static-policies`, `/api/v1/dynamic-policies`
 - Both parameters work during transition period; `limit` takes precedence

- **SDK: ExecuteQuery → ProxyLLMCall**: Renamed for clearer Proxy Mode semantics
 - **Action Required:** Migrate from `executeQuery()` to `proxyLLMCall()` before the next major release
 - Old methods emit deprecation warnings and **will be removed in v4.0.0**
 - New names clarify the two integration modes:
 - **Proxy Mode:** `proxyLLMCall()` - AxonFlow proxies your LLM request
 - **Gateway Mode:** `getPolicyApprovedContext()` + `auditLLMCall()` - You call LLM directly
 - All SDK examples and demos updated to use new method names
 - Applies to: Go SDK, TypeScript SDK, Python SDK, Java SDK

### Enterprise

#### Added

- **MAS FEAT Compliance Module**: Singapore financial services AI governance framework
 - Implements Monetary Authority of Singapore FEAT (Fairness, Ethics, Accountability, Transparency) guidelines
 - AI System Registry with 3-Dimensional Risk Rating (Customer Impact × Model Complexity × Human Reliance)
 - Materiality Classification: High (sum≥12), Medium (sum≥8), Low (sum<8)
 - FEAT Assessment lifecycle: pending → in_progress → completed → approved/rejected
 - Four pillar scoring: Fairness, Ethics, Accountability, Transparency (with detailed sub-metrics)
 - Kill Switch with automatic triggering based on accuracy, bias, and error rate thresholds
 - 7-year audit retention for regulatory compliance
 - Singapore-specific PII detection with Verhoeff checksum validation (NRIC, FIN, UEN)

- **MAS FEAT Database Schema**: New tables for compliance data
 - `ai_system_registry` - AI system registration with materiality tracking
 - `feat_assessments` - FEAT assessment records with pillar scores
 - `kill_switch` - Kill switch configuration and status
 - `kill_switch_events` - Kill switch event audit log

- **MAS FEAT API Endpoints**: Full REST API for compliance operations
 - AI System Registry CRUD (`/api/v1/masfeat/registry/*`)
 - FEAT Assessment lifecycle (`/api/v1/masfeat/assessments/*`)
 - Kill Switch management (`/api/v1/masfeat/killswitch/*`)

- **Compliance Runtime Wiring**: Enterprise compliance module initialization
 - RBI, SEBI, EU AI Act, and MAS FEAT module initialization with health checks
 - Compliance route registration (`/api/v1/rbi/*`, `/api/v1/sebi/*`, `/api/v1/euaiact/*`, `/api/v1/masfeat/*`)
 - Compliance examples with strict HITL assertion validation

- **HITL Execution Store**: In-memory store with SaveExecution/GetExecutionStatus for pause/resume workflow

- **SCIM Provisioning Examples**: User, group, token management examples

- **WCP HITL Queue Integration**: `require_approval` policy actions now create HITL queue entries
 - Enterprise: Database persistence in `hitl_approval_queue` with `wcp_step_gate` request type
 - Community: No-op stub with informational logging
 - 24-hour default expiry for approval requests
 - New E2E example at `ee/examples/workflows/wcp-hitl/go` verifying queue entry creation

#### Fixed

- **WCP HITL Approval Queue Insert**: Fixed INSERT query for `hitl_approval_queue` table
 - Removed explicit `id` column from INSERT (now auto-generated by sequence)
 - `request_id` (UUID) is the primary identifier for approval requests

- **SDK Examples Fixes**: Fixed enterprise examples (eu-ai-act, rbi-sebi, healthcare, llm-providers/e2e-tests) across all 4 SDKs

#### SDK Support

- TypeScript SDK v2.7.0: `client.masfeat.*` namespace, `budgetInfo`
- Python SDK v1.7.0: `client.masfeat.*` namespace, `budget_info`
- Go SDK v2.7.0: `client.MASFEAT*()` methods, `BudgetInfo`
- Java SDK v2.7.0: `client.masfeat().*` namespace, `getBudgetInfo()`

---

## [3.5.0] - 2026-01-18

### Added

- **Workflow Policy Enforcement**: Policy evaluation at workflow transitions
 - **MAP Policy Enforcement**: Dynamic policy evaluation before plan execution
 - Policy check in `executePlanHandler` with allow/block decisions
 - `PolicyInfo` field in `PlanResponse` with evaluated policies and risk score
 - Policy results recorded in step execution snapshots for replay/audit
 - **WCP Policy Enforcement**: Connect WCP to dynamic policy engine
 - New `WCPPolicyAdapter` bridges workflow_control to orchestrator policy engine
 - `policies_evaluated` and `policies_matched` fields in `StepGateResponse`
 - Detailed policy match information (policy_id, policy_name, action, reason)
 - Support for allow/block/require_approval decisions based on policy evaluation

### Tests

- Added unit tests for MAP policy enforcement (blocked/allowed scenarios)
- Added unit tests for WCP policy adapter (allow/block/require_approval/nil engine)
- Added unit tests for WCP policy info in response (4 new test cases)

### Documentation

- Updated `docs/api/orchestrator-api.yaml` with policy info fields in PlanResponse and StepGateResponse
- Added `PolicyMatch` schema for detailed policy evaluation results

---

## [3.4.0] - 2026-01-17

### Added

- **Workflow Control Plane V1**: Governance gates for external orchestrators (LangChain, LangGraph, CrewAI)
 - "LangChain runs the workflow. AxonFlow decides when it's allowed to move forward."
 - Register workflows from external orchestrators with `POST /api/v1/workflows`
 - Step gate checks with allow/block/require_approval decisions
 - Policy evaluation at step transitions with new `workflow` scope
 - Workflow lifecycle tracking (in_progress/completed/aborted/failed)
 - New database tables: `workflows`, `workflow_steps`
 - SDK support: Go, TypeScript (Python and Java in standalone repos)
 - Examples: HTTP, Go, Python, TypeScript, Java + LangGraph adapter

- **Grafana Dashboard**: Security & Compliance section with PII detection, provider distribution, and policy metrics panels

### Fixed

- Improved enterprise license validation consistency

### Documentation

- New guide: `docs/guides/workflow-control-plane.md` - Workflow Control Plane user guide
- Updated API spec: `docs/api/orchestrator-api.yaml` - Workflow endpoints

---

## [3.3.0] - 2026-01-16

### Added

- **MCP Connector Audit Logging**: Full audit trail for all MCP connector queries and commands
 - New `mcp_query_audits` table captures all MCP operations with policy evaluation results
 - REQUEST phase logging: SQLi detection, PII blocking, matched policies
 - RESPONSE phase logging: PII redaction, redacted field paths (JSONPath format)
 - EXFILTRATION logging: Row counts, volume limit violations
 - Compliance mode (sync) for violations, performance mode (async) for success
 - Statement privacy: SHA256 hash stored instead of raw queries
 - `audit_id` field correlates with SDK `PolicyInfo` for traceability

- **MCP Audit Examples**: Comprehensive examples for all 4 SDKs + HTTP API
 - `examples/mcp-audit/http/` - HTTP API examples (curl/bash)
 - `examples/mcp-audit/go/` - Go SDK example
 - `examples/mcp-audit/python/` - Python SDK example
 - `examples/mcp-audit/typescript/` - TypeScript SDK example
 - `examples/mcp-audit/java/` - Java SDK example

### Documentation

- New guide: `docs/guides/audit-logging.md` - Comprehensive audit logging architecture guide
- New guide: `docs/guides/mcp-audit-logging.md` - MCP audit logging configuration and usage
- Updated API docs: `docs/api/agent-api.yaml` - Added audit logging details to MCP endpoints

---

## [3.2.0] - 2026-01-14

### Added

- **MCP Exfiltration Detection**: Row and data volume limits for MCP connector queries
 - Configurable row count limits (default: 10,000 per query)
 - Configurable data volume limits (default: 10MB per response)
 - Returns 403 with detailed limit information when exceeded
 - `ExfiltrationCheck` field in `PolicyInfo` response

- **MCP Dynamic Policy Evaluation**: Real-time policy evaluation via Orchestrator
 - Pre-query policy evaluation for rate limits, budgets, time/role access
 - Graceful degradation when Orchestrator is unavailable
 - `DynamicPolicyInfo` field in `PolicyInfo` response

### Fixed

- Removed unused `MCP_DYNAMIC_POLICIES_ENDPOINT` environment variable

### Tests

- Added integration tests for MCP exfiltration and dynamic policy features

### Documentation

- Updated community/enterprise feature matrix with MCP policy features

---

## [3.1.0] - 2026-01-09

### Added

- **MCP Tiered Policy Enforcement**: Phase-aware policy enforcement for MCP connector requests
 - REQUEST phase: SQLi pattern blocking (DROP TABLE, UNION SELECT, OR 1=1, DELETE, TRUNCATE)
 - REQUEST phase: Critical PII blocking (SSN, Credit Card, India PAN, Aadhaar)
 - RESPONSE phase: PII redaction in connector data (SSN, Credit Card masked)
 - PolicyInfo metadata in all MCP responses (`policies_evaluated`, `redactions_applied`, `processing_time_ms`)
 - Non-critical PII (Email, Phone) allowed through with logging

- **MCP PII Redaction Examples**: Comprehensive examples for all 4 SDKs + HTTP API
 - `examples/mcp-policies/pii-redaction/go/` - Go SDK example
 - `examples/mcp-policies/pii-redaction/python/` - Python SDK example
 - `examples/mcp-policies/pii-redaction/typescript/` - TypeScript SDK example
 - `examples/mcp-policies/pii-redaction/java/` - Java SDK example
 - `examples/mcp-policies/pii-redaction/http/` - HTTP API examples (curl)

### Enterprise

- **Healthcare PHI Patterns**: Enterprise example for HIPAA-compliant PHI detection
 - Medical Record Number (MRN) detection
 - DEA Number detection
 - NPI (National Provider Identifier) detection
 - Medicare Beneficiary Identifier (MBI) detection
 - ICD-10 code detection

### Fixed

- **Healthcare example**: Fixed policy verification to use `GetStaticPolicy` instead of `ListStaticPolicies`

---

## [3.1.1] - 2026-01-09

### Fixed

- **MAP GetPlanStatus API**: Fixed response fields to match SDK expectations
 - Changed `step_count` to `total_steps` in API response
 - Added `completed_steps` field (0 when pending, equals total_steps when completed)
 - SDK methods `GetPlanStatus()` / `get_plan_status()` now correctly receive step tracking info

---

## [3.0.2] - 2026-01-08

### Fixed

- **Agent proxy routes**: Fixed missing proxy routes for `/api/v1/pricing`, `/api/v1/plan`, and `/api/v1/audit` endpoints. SDK methods like `getPricing()`, `generatePlan()`, `executePlan()`, and `searchAuditLogs()` now work correctly through the Agent single entry point. Previously these returned 404 errors.

### Changed

- **GoReleaser upgraded to v2**: Release workflow now uses GoReleaser v2 configuration format for better compatibility.

### Enterprise

- **OAuth2 Basic auth support**: Agent now accepts `Authorization: Basic base64(clientId:clientSecret)` for authentication, in addition to existing `X-License-Key` header.
- **Code governance: ClosePR endpoint**: Added endpoint for closing PRs without merging, useful for cleaning up test/demo PRs.

---

## [3.0.1] - 2026-01-07

### Fixed

- **Multi-Agent Planning (MAP) Two-Step Execution**: Fixed race condition where plan execution started before DB commit
 - `GeneratePlan` now stores workflow plan in database with 1-hour TTL before returning
 - `ExecutePlan` retrieves stored plan by `plan_id` and executes workflow
 - New `migrations/core/037_plans.sql` - Plans table for deferred execution
 - New `migrations/core/038_plans_composite_index.sql` - Composite index for cross-tenant queries
 - New `platform/orchestrator/planning/` package (service, repository, types)
 - Agent routes `execute-plan` requests to `/api/v1/plan/execute`

- **Agent Environment Variable Support for ECS/K8s**: Fixed orchestrator URL detection in containerized environments
 - Agent now checks `ORCHESTRATOR_URL` env var first (required for ECS, Kubernetes)
 - Priority: env var → Docker detection → localhost fallback
 - Increased MAP timeout to 60s

- **Support Demo Fixes**: Fixed broken support-demo in community repo
 - Removed vendor dependency causing Docker build failures
 - Fixed network naming (`axonflow_axonflow-network` requires `COMPOSE_PROJECT_NAME=axonflow`)
 - Removed direct orchestrator calls (all requests go through Agent)
 - Fixed role/region provider display for EU users

- **Dynamic Policy API Path**: Fixed incorrect API path in examples
 - Changed `/api/v1/policies/dynamic` → `/api/v1/dynamic-policies`

- **Dynamic Policy Payload Format**: Fixed condition format in examples
 - Changed `conditions: "{}"` → `conditions: "[]"` (array, not object)

### Added

- **Portal Proxy Routes (Enterprise)**: Agent now proxies `/api/v1/auth/*` for portal authentication

---

## [3.0.0] - 2026-01-05

### Breaking Changes

- **Single Entry Point Architecture**: All API routes now go through the Agent (port 8080)
 - Agent proxies `/api/v1/dynamic-policies/*`, `/api/v1/budgets/*`, `/api/v1/usage/*`, `/api/v1/executions/*` to Orchestrator
 - Agent proxies `/portal/*` routes to Customer Portal
 - SDKs now use single `endpoint` parameter (default: `http://localhost:8080`)
 - **Deprecated**: `agent_url` and `orchestrator_url` SDK parameters (use `endpoint` instead)
 - **Deprecated**: Direct Orchestrator access on port 8081 (still works but not recommended)

- **Detection Defaults Changed**: More nuanced default actions based on detection confidence
 - PII detection: `block` → `redact` (non-blocking, better UX)
 - High risk score (>0.8): `block` → `warn` (composite score needs tuning)
 - SQL injection: remains `block` (high confidence attacks)
 - Dangerous queries (DROP/TRUNCATE): remains `block` (destructive operations)

- **Environment Variable Changes**:
 - **New**: `SQLI_ACTION` (values: `block`, `warn`, `log`) - replaces `SQLI_BLOCK_MODE`
 - **New**: `PII_ACTION` (values: `block`, `warn`, `redact`, `log`) - replaces `PII_BLOCK_CRITICAL`
 - **New**: `SENSITIVE_DATA_ACTION` (values: `block`, `warn`, `log`) - credentials/secrets detection
 - **New**: `HIGH_RISK_ACTION` (values: `block`, `warn`, `log`) - high risk score threshold
 - **New**: `DANGEROUS_QUERY_ACTION` (values: `block`, `warn`, `log`) - DROP/TRUNCATE detection
 - **Deprecated**: `SQLI_BLOCK_MODE` (use `SQLI_ACTION` instead)
 - **Deprecated**: `PII_BLOCK_CRITICAL` (use `PII_ACTION` instead)

### Added

- **Sensitive Data Patterns in Database**: Credential and secret detection patterns now stored in `static_policies` table
 - Password, API key, token, secret, credentials, connection string patterns
 - Context exclusions for SQL keywords (PRIMARY KEY, FOREIGN KEY no longer false positives)
 - Per-tenant customization via policy overrides (Enterprise)

- **Environment Variable Precedence**: Clear hierarchy for detection configuration
 1. Per-tenant policy override (API) - highest priority
 2. Environment variable (docker-compose)
 3. Per-policy DB default (migration seed) - lowest priority

- **PII Redaction Support in SDKs**: New `requiresRedaction` field in `PolicyApprovalResult`
 - Returns `true` when PII was detected with `redact` action
 - Callers should process response for redaction when this flag is set
 - Available in all SDKs: `isRequiresRedaction()` (Java), `requires_redaction` (Python), `RequiresRedaction` (Go), `requiresRedaction` (TypeScript)

- **Strict Provider Enforcement for Dynamic Policies**: Compliance-aware LLM routing
 - Policies can specify `allowed_providers` to restrict which LLM providers handle requests
 - Requests **fail** (instead of fallback) if no compliant provider is available
 - Multiple policies use **intersection logic** (least privilege - most restrictive wins)
 - Enables GDPR, HIPAA, RBI compliance scenarios (e.g., EU data stays on-premise)
 - Example: `{"allowed_providers": ["ollama"]}` ensures only local model handles sensitive data

### Fixed

- **Dynamic policy condition evaluation**: `DatabaseDynamicPolicyEngine` now correctly evaluates conditions before applying actions
 - Previously, all policy actions were applied regardless of whether conditions matched
 - Now supports operators: `equals`, `not_equals`, `contains`, `not_contains`, `contains_any`, `regex`, `greater_than`, `less_than`, `in`, `not_in`

- **Tenant extraction bug**: Fixed `Client.ID` → `Client.TenantID` in policy evaluation

### Changed

- **SDK Method Signatures**: All SDKs updated for single endpoint
 - Go: `axonflow.NewClient(axonflow.AxonFlowConfig{Endpoint: "http://localhost:8080"})`
 - Python: `AxonFlow(endpoint="http://localhost:8080")`
 - TypeScript: `new AxonFlow({ endpoint: "http://localhost:8080" })`
 - Java: `AxonFlow.create(AxonFlowConfig.builder().endpoint("http://localhost:8080").build())`

### Migration Guide

**SDK Migration:**
```python
# Before (v2.x)
client = AxonFlow(
 agent_url="http://localhost:8080",
 orchestrator_url="http://localhost:8081"
)

# After (v3.0)
client = AxonFlow(endpoint="http://localhost:8080")
```

**Environment Variable Migration:**
```yaml
# Before (v2.x)
SQLI_BLOCK_MODE: "block"
PII_BLOCK_CRITICAL: "true"

# After (v3.0)
SQLI_ACTION: "block"
PII_ACTION: "redact"
SENSITIVE_DATA_ACTION: "warn"
HIGH_RISK_ACTION: "warn"
```

---

## [2.6.0] - 2026-01-04

### Added

- **Decision & Execution Replay API**: Debug and audit workflow executions with full state capture and policy decisions
 - `GET /api/v1/executions` - List executions with filtering (status, time range, agent/workflow)
 - `GET /api/v1/executions/{id}` - Get execution with all step snapshots
 - `GET /api/v1/executions/{id}/steps` - Get individual step snapshots
 - `GET /api/v1/executions/{id}/timeline` - Timeline view for visualization
 - `GET /api/v1/executions/{id}/export` - Export for compliance and archival
 - `DELETE /api/v1/executions/{id}` - Delete execution records
 - SDK examples for Go, Python, TypeScript, Java

- **Cost Controls Phase 1**: Budget management and LLM usage tracking
 - Budget scopes: Organization, Team, Agent, Workflow, User
 - Budget periods: Daily, Weekly, Monthly, Quarterly, Yearly
 - Enforcement actions: Warn, Block, Downgrade on exceed
 - Configurable alert thresholds (default 50%, 80%, 100%)
 - Usage aggregation: Hourly, Daily, Weekly, Monthly
 - Provider pricing for OpenAI, Anthropic, Azure, Gemini, Bedrock, Ollama
 - SDK examples for Go, Python, TypeScript, Java

### Fixed

- **Replay Data Race**: Fixed race condition in background summary update when multiple goroutines access execution state

### Documentation

- **SDK method inclusion criteria for feature parity decisions
- **SDK Feature Coverage**: Cross-SDK method availability matrix

---

## [2.5.0] - 2026-01-02

### Added

- **Azure OpenAI Provider** (Community): Native Azure OpenAI Service integration
 - Supports both Azure AI Foundry (`cognitiveservices.azure.com`) and Classic (`openai.azure.com`) endpoints
 - Automatic authentication detection (Bearer token vs api-key header)
 - Streaming support via `GenerateContentStream`
 - Health checks and provider status endpoints
 - Environment variables: `AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_API_KEY`, `AZURE_OPENAI_DEPLOYMENT_NAME`, `AZURE_OPENAI_API_VERSION`

- **Azure OpenAI Examples**: Complete example suite
 - Hello World (Go, Python, TypeScript, Java, HTTP)
 - PII Detection (Python)
 - SQL Injection Scanning (TypeScript)
 - Proxy Mode (Go)

- **README Philosophy Section**: Added positioning section explaining AxonFlow's "secure-by-default, configurable enforcement" approach for LLM discoverability

### Changed

- **Docker Compose UX**: Reorganized environment variables for better developer experience
 - **CORE CONFIGURATION**: 10 essential variables (LLM API keys, Azure config, ports, deployment mode)
 - **ADVANCED CONFIGURATION**: Defaults work for most users (database, internal services, routing)
 - Added explicit security configuration toggles (`SQLI_SCANNER_MODE`, `SQLI_BLOCK_MODE`)

### Documentation

- Added Azure OpenAI to Supported LLM Providers in README
- Provider documentation at `docs/llm/azure-openai.md`
- Updated Community vs Enterprise feature matrix

---

## [2.4.0] - 2025-12-31

### Changed

- **DEPLOYMENT_MODE Unification**: Single env var for auth (`community` = no auth, `enterprise` = license required)
 - Replaces `SELF_HOSTED_MODE` with clearer naming
 - New `isCommunityMode()` helper for consistent mode checks

### Added

- **MCP Connector Examples**: Python, TypeScript, Java implementations
- **Workflow Examples**: 6 patterns (sequential, parallel, conditional, fallbacks, pipelines, approvals)

### Fixed

- Shell script audit endpoint URL corrected
- Unit tests for enterprise mode validation

---

## [2.3.0] - 2025-12-30

### Changed

- **LLM Router Consolidation**: Completed migration to interface-based router architecture
 - Removed legacy `LLMRouter` concrete implementation (~1,700 lines)
 - All routing now through `LLMRouterInterface` abstraction introduced in v2.2.0
 - Cleaner codebase with single routing implementation path

- **Docker Compose Architecture**: Simplified deployment configuration
 - `docker-compose.yml` now serves as Community base configuration
 - Enterprise features available via overlay pattern

- **Default Anthropic Model**: Updated to `claude-sonnet-4-20250514` (Claude 4)

### Added

- **LLM Provider E2E Tests**: Comprehensive end-to-end test suite
 - Coverage for OpenAI, Anthropic, Google Gemini, and AWS Bedrock
 - Multi-language test implementations (Go, Python, TypeScript, Java)

### Removed

- `llm_router.go` - Superseded by `UnifiedRouterWrapper`
- `llm_routing_strategy.go` - Consolidated into unified router
- Legacy router test files

---

## [2.2.0] - 2025-12-29

### Added

- **LLM Router Interface Abstraction**: Components now depend on standard interface rather than concrete implementations
 - `LLMRouterInterface` - Standard interface for router abstraction
 - `UnifiedRouterWrapper` - Adapter enabling UnifiedRouter as drop-in LLMRouter replacement
 - Type conversion utilities between legacy and new router types

- **LLM Provider Routing Examples**: New HTTP/curl examples for direct API access
 - Shell script examples for all supported providers (OpenAI, Anthropic, Ollama, Gemini)
 - Gateway mode pre-check and audit examples
 - Java SDK example for provider routing

### Changed

- Orchestrator now uses interface type for LLM router configuration
- Improved test coverage for audit logging and routing strategies

---

## [2.1.0] - 2025-12-28

### Added

- **Human-in-the-Loop (HITL)**: New `require_approval` policy action for human oversight
 - Enterprise: Pauses execution, creates approval request in HITL queue
 - Community: Auto-approves (upgrade path to Enterprise)
 - EU AI Act Article 14 and SEBI AI/ML compliance support

- **Code Governance**: Automatic detection and audit of LLM-generated code
 - Identifies language, code type, potential secrets, unsafe patterns
 - Detects eval, exec, shell injection risks
 - Metadata logged for compliance

- **LLM Provider Routing**: Runtime control over provider selection
 - Weighted routing across providers
 - Health-based automatic failover
 - Per-request provider preferences

### Fixed

- Anthropic provider now respects `ANTHROPIC_MODEL` environment variable
- Support demo build and runtime fixes
- HITL example tier filter fixes

---

## [2.0.0] - 2025-12-25

**Unified Policy Architecture - Major Release**

This major release introduces enterprise-grade policy management to AxonFlow with a new three-tier hierarchy for granular control at every level.

### ⚠️ Breaking Changes

**Category Enum Values Changed in Responses**

| Old Category | New Category |
|--------------|--------------|
| `sql_injection` | `security-sqli` |
| `admin_access` | `security-admin` |
| `pii_detection` | `pii-global`, `pii-us`, `pii-eu`, `pii-india` |
| `dangerous_queries` | `security-sqli` |

**Migration Notes:**
- Old category values are still accepted in **request** parameters (backwards compatible)
- Update your code if you're parsing category values from **responses**
- SDKs don't require updates - they pass through category values as strings

### Added

- **Three-Tier Policy Hierarchy**: New policy architecture with System → Organization → Tenant inheritance
 - **System Tier**: 63 immutable security policies (53 static + 10 dynamic)
 - **Organization Tier**: Company-wide policies (Enterprise only)
 - **Tenant Tier**: Team-specific policies with full CRUD
 - Tier-aware policy resolution with caching

- **63 System Policies**: Comprehensive security and compliance coverage out-of-the-box
 - **Security - SQL Injection** (37): UNION, boolean-based, time-based, stacked queries, etc.
 - **Security - Admin Access** (4): Users table, audit log, config table access
 - **PII - Global** (7): Credit card, email, phone, IP, passport, DOB
 - **PII - US** (2): SSN, bank accounts
 - **PII - EU** (1): IBAN
 - **PII - India** (2): PAN, Aadhaar
 - **Dynamic** (10): Risk, compliance (HIPAA, GDPR), cost, access control

- **Policy CRUD APIs**: Full create, read, update, delete for organization and tenant policies
 - `GET /api/v1/static-policies` - List with tier/category filtering
 - `POST /api/v1/static-policies` - Create custom policy
 - `PUT /api/v1/static-policies/{id}` - Update policy
 - `DELETE /api/v1/static-policies/{id}` - Delete policy
 - `GET /api/v1/effective-policies` - Get merged hierarchy for tenant

- **Policy Overrides** (Enterprise): Customize system policy behavior
 - Disable system policies for organization
 - Change action (only to more restrictive)
 - Expiration dates for temporary overrides
 - Audit trail with reason requirement

- **SDK Policy Methods**: All 4 SDKs support policy management
 - TypeScript: `listStaticPolicies()`, `createStaticPolicy()`, etc.
 - Python: `list_static_policies()`, `create_static_policy()`, etc.
 - Go: `ListStaticPolicies()`, `CreateStaticPolicy()`, etc.
 - Java: `listStaticPolicies()`, `createStaticPolicy()`, etc.

- **Customer Portal UI**: Visual policy management for Enterprise customers
 - Unified policy dashboard
 - Override management
 - Policy testing interface

### Changed

- **Policy Categories**: New category naming convention
 - `security-sqli`, `security-admin` for security policies
 - `pii-global`, `pii-us`, `pii-eu`, `pii-india` for PII detection
 - `dynamic-risk`, `dynamic-compliance`, `dynamic-cost`, `dynamic-access` for context-aware policies

- **Performance**: Static policy evaluation maintains < 5ms p99 latency
 - Tier-aware caching with configurable TTL
 - Optimized regex pattern compilation

### Fixed

- **PII Detection Priority**: Credit card detection now correctly takes priority over phone number detection
 - Root cause: Policies were sorted by severity string (alphabetically "medium" > "critical")
 - Fix: Changed to `ORDER BY priority DESC` using numeric priority field

- **Tenant Policy Isolation**: Tenant-specific policies now only apply to their respective tenants
 - Root cause: `LoadPoliciesFromDB()` was loading ALL policies without tier filtering
 - Fix: Added two-phase evaluation - system policies via fast path, tenant policies via tier-aware engine

### Enterprise Features

- Organization-tier policy management
- System policy override capabilities
- Policy version history
- Customer Portal policy UI

---

## [1.1.3] - 2025-12-21

### Fixed

- **Usage Recording:** Fixed postgres errors in Community mode when `usage_events` table doesn't exist ([#96](https://github.com/getaxonflow/axonflow/issues/96))
 - Usage metering is now properly separated as an Enterprise-only feature
 - Community builds have zero-overhead no-op implementation using build tags
 - Thanks to [@gzak](https://github.com/gzak) for identifying and contributing the initial fix ([#97](https://github.com/getaxonflow/axonflow/pull/97))

- **OpenAI Provider:** Fixed "you must provide a model parameter" error when `OPENAI_MODEL` not explicitly set ([#100](https://github.com/getaxonflow/axonflow/pull/100))
 - `OpenAIProvider` now reads `OPENAI_MODEL` environment variable with `gpt-4o` fallback
 - Consistent with other providers (Anthropic, Gemini, Ollama)

### Changed

- **Code Cleanup:** Removed 450+ lines of dead code
 - Removed unused `AnthropicProvider` struct (superseded by `EnhancedAnthropicProvider`)
 - Usage package refactored with build tags for clean Community/Enterprise separation

---

## [1.1.2] - 2025-12-20

### Fixed

- **LLM Router:** Use provider's configured model instead of hardcoded defaults ([#94](https://github.com/getaxonflow/axonflow/pull/94))
 - Previously, `selectModel()` returned hardcoded model names (e.g., `gpt-3.5-turbo`, `claude-3-5-sonnet`) which caused failures when the API key didn't have access to those specific models
 - Now respects `OPENAI_MODEL`, `ANTHROPIC_MODEL`, and other provider-specific environment variables
 - Model specified in request context takes highest priority

### Changed

- Added `OPENAI_MODEL` and `ANTHROPIC_MODEL` environment variable passthrough in docker-compose.yml

---

## [1.1.1] - 2025-12-20

### Fixed

- **Self-hosted mode:** Fixed authentication bypass not working when `userToken` is empty or omitted ([#89](https://github.com/getaxonflow/axonflow/pull/89))
 - Previously, self-hosted mode required a dummy `userToken`/`apiKey` even though it should accept requests without credentials
 - Now correctly bypasses authentication when `SELF_HOSTED_MODE=true` and `SELF_HOSTED_MODE_ACKNOWLEDGED=I_UNDERSTAND_NO_AUTH` are set
 - Thanks to [@gzak](https://github.com/gzak) for the contribution

---

## [1.1.0] - 2025-12-19

**SDK Feature Parity & Terminology Update**

### Added

- **Google Gemini LLM Provider**: Native Gemini integration now available in Community edition
 - Supports Gemini Pro and Gemini Pro Vision models
 - Automatic failover and routing alongside OpenAI, Anthropic, Ollama

- **SDK Feature Parity**: All four SDKs now have complete feature parity
 - **TypeScript SDK** (v1.4.0): 85.75% test coverage
 - **Python SDK** (v0.3.0): 71.39% test coverage
 - **Java SDK** (v1.1.0): 81.9% test coverage
 - **Go SDK** (v1.5.0): 82.8% test coverage

- **LLM Interceptors** (all SDKs): Wrapper-based governance for LLM providers
 - OpenAI, Anthropic, Gemini, Ollama, AWS Bedrock interceptors
 - Gateway Mode: Two-phase policy checking with `getPolicyApprovedContext()` and `auditLLMCall()`
 - Proxy Mode: Single-call governance with `executeQuery()`

### Changed

- **Terminology**: Renamed "OSS" to "Community" across the entire codebase
 - Environment variable: `AXONFLOW_MODE=community` (previously `oss`)
 - API responses: `"mode": "community"` (previously `"oss"`)
 - Documentation updated throughout

### Breaking Changes

- **`AXONFLOW_MODE` Environment Variable**: If you were using `AXONFLOW_MODE=oss`, update to `AXONFLOW_MODE=community`
- **API Response**: The `mode` field in API responses now returns `"community"` instead of `"oss"`

### Migration Notes

To upgrade from 1.0.x:

1. Update environment variables:
 ```bash
 # Before
 AXONFLOW_MODE=oss

 # After
 AXONFLOW_MODE=community
 ```

2. Update any code that checks for `mode === "oss"` to check for `mode === "community"`

3. Update SDKs to latest versions for LLM Interceptors support

---

## [1.0.1] - 2025-12-16

### Added

- **Internal Service Authentication**: Shared secret authentication for secure agent↔orchestrator communication via `AXONFLOW_INTERNAL_SERVICE_SECRET`

### Changed

- **PII Detection**: Made critical PII blocking configurable per-policy (Aadhaar, PAN patterns)

---

## [1.0.0] - 2025-12-14

**Community Launch Release**

This is the first public release of AxonFlow, a self-hosted governance and orchestration platform for production AI systems.

### Core Platform

- **Policy Enforcement Agent**: Real-time policy enforcement with single-digit millisecond overhead
 - Static policy engine with configurable rules
 - PII detection (SSN, credit cards, PAN, Aadhaar)
 - SQL injection blocking in user inputs
 - Rate limiting and request validation

- **Multi-Agent Planning (MAP)**: Declarative agent orchestration
 - YAML-based agent configuration
 - Natural language to workflow conversion
 - Sequential and parallel execution modes
 - Error handling with fallbacks

- **MCP Connectors**: Model Context Protocol integration
 - PostgreSQL, MySQL, MongoDB, Redis, HTTP connectors (Community)
 - Salesforce, Slack, Snowflake, ServiceNow (Enterprise)

- **Gateway Mode**: Wrap existing LLM calls with governance
 - Pre-check → your LLM call → audit trail
 - Incremental adoption path for existing codebases

- **Multi-Model Routing**: Intelligent LLM provider management
 - OpenAI, Anthropic, Ollama (Community)
 - AWS Bedrock, Google Gemini (Enterprise)
 - Automatic failover and cost-based routing

### Security & Compliance

- **SQL Injection Response Scanning**: Detect SQLi payloads in MCP connector responses
 - 37 regex patterns across 8 attack categories
 - Monitoring mode by default (detect and log, configurable blocking)
 - Per-connector configuration overrides
 - Audit trail integration for compliance
 - Basic scanner (Community), Advanced ML-based scanner (Enterprise)

- **EU AI Act Compliance** (Articles 12, 13, 14, 15, 43):
 - Decision chain tracing with full audit trails
 - Transparency headers (X-AI-Decision-ID, X-AI-Model-Provider, etc.)
 - Human-in-the-Loop (HITL) workflows (Enterprise)
 - Conformity assessment endpoints (Enterprise)
 - Emergency circuit breaker (Enterprise)

- **RBI FREE-AI Framework**: Data integrity monitoring for financial AI (India)

- **SEBI AI/ML Guidelines**: Security audit trail for investment platforms (India)

### Infrastructure

- **Docker Compose Deployment**: Local development in under 5 minutes
- **Row-Level Security**: Database-level multi-tenant isolation
- **Production Migrations**: Idempotent, versioned database migrations
- **Test Coverage**: 70%+ coverage across core packages

### Documentation

- Getting Started Guide
- LLM Provider Configuration
- MCP Connector Development Guide
- Security Best Practices
- EU AI Act Compliance Guide

---

## Links

- [GitHub Repository](https://github.com/getaxonflow/axonflow)
- [Documentation](https://docs.getaxonflow.com)
- [AWS Marketplace](https://aws.amazon.com/marketplace)
- [Security Policy](./SECURITY.md)
- [Contributing Guide](./CONTRIBUTING.md)

---

**For a complete list of changes, see the [commit history](https://github.com/getaxonflow/axonflow/commits/main).**