Release notes

Newest first. Versions are pre-1.0 during the pilot; semver kicks in at GA. Material breaking changes get their own callout.

0.9 — Enterprise pre-GA

2026-05

Pluggable identity providers: Microsoft Entra (workforce), Microsoft Entra External ID, Google, GitHub, and a generic OIDC bridge (terminates SAML upstream via dex/Keycloak/Auth0/Cloudflare). External ID setup.
SCIM 2.0 user provisioning. Connect Okta, Entra Provisioning, OneLogin, or JumpCloud and keep your roster in sync. SCIM guide.
RBAC mapping via Entra group claims (closed-default; bootstrap admin escape hatch). Surfaced at Users & RBAC.
Audit log: every security-relevant action lands in /admin/audit-log. Sign-in, role change, SCIM provisioning, API key lifecycle, source connect/disconnect.
Tenant-isolation middleware: cross-tenant data access is now impossible by construction. 11 boundary tests in CI.
Security headers: HSTS, CSP, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy.
Rate limiting on /api/*: 60 req/60s per (IP, path-prefix).
Public /status page reading live /api/health.
SOC 2 / ISO 27001 control posture at /admin/soc2-posture — control-by-control evidence map.
Dark theme with FOUC-free pre-paint script.
BYOK encryption scaffold (src/lib/crypto/byok.ts) — production-managed key today, per-tenant CMK on the roadmap.

2026-05

Service registry now covers Azure / AWS / GCP / K8s / SaaS / on-prem (226 services across 48 PlatformCategory enums).
Three-view coverage page (Executive / Engineer / Architect) at /service-coverage.
Per-vendor identity catalog at /platform-capabilities.
5-level capability grading (native / partial / inferred / roadmap / unavailable).

2026-04

External ID customer signup with 45K MAU cap (10% safety margin under Microsoft's 50K free tier).
Per-month MAU dashboard with soft/medium/hard warnings + automatic signup block at 95%+.
Reconciliation hint against Microsoft Graph Audit Logs.

2026-04