Unreleased
the v1.6.0 lineRelease-blocking
- A failed deploy would have redeployed itself every ten seconds, for ever.
Added
- The alerting subsystem had never delivered an alert in production.
Security
- A foreign tenant could write into another organisation.
- **The only ENROLLMENT-key mint in the product was guarded by a membership row
- **Rotation — the documented compromise-recovery path — did not retire
- Forty-one handlers authorised on a membership row merely existing.
- The webhook sender could reach anything the server could reach. No scheme
- An orphaned device was adoptable by anyone who knew its serial.
- Cancelling your own batch could stop another tenant's commands.
- The M-Pesa STK push took its price and its recipient from the request body,
- Two org GETs had `auth()` as their whole authorization —
log-settings - `ApiKey.lastUsedAt` had zero writers, so revocation was unmeasurable —
Fixed
- The `/help` renderer was breaking every numbered procedure it served.
- The deleted V3 device-command channel's client half was still being served.
Changed
- **Thirty-eight contract pins could not fail, and the class is now closed —
- **Thirteen pinned statuses disagreed with the measurement while the suite was
- Two ratchets were budgets for silent regression. The tenancy ceiling sat at
OPEN_TENANCY_DEBT119 → 115 across the day. Three of those are a
Documentation
- Two agent skills promised safety nets that do not exist — a pre-migration
- The 2026-07-22 deploy runbook documented a rollback that deploys.
Security
- MISS-1 — a device id equal to an organisation id granted the organisation.
- The archive bucket was identified by a name anyone could take.
- A moved device left the losing org a firmware handle, and a **suspended
Added
- The device-tenancy ratchet (S1-b) — an AST ESLint rule plus an independent
- Atomic ownership auditing —
archive,moveandwipewrite an - Two documentation guards.
documented-surface-counts.test.tsfails when
Added
- Alerting, end to end. Rule engine wired so syslog signals become alerts;
- Native ML slices (§6.3): new-template anomaly detection, cross-device
- Syslog ingest pipeline wired into
SyslogServer— parsed, rate-limited, - Device page: live port/SFP/uplink state, subscribers-on-device, a polling
- Darkest-blue glassmorphism design system, with Live Config and Subscribers
- Billing lifecycle foundations:
BillingHoldandAuditEventmodels, a - S1 canonical audit writer — one writer, three entry points with three
- Helix Internet Monitor integration: the wire contract vendored and pinned
- Fleet inventory (read-only) of RouterOS login identity, and read-back of
Fixed
- F-13 — a payment now settles the invoice it paid, on all four payment
- F-14 / F-27 — a renewal bills a full period, and a delinquent subscription
- DD-5 — a telemetry gap renders as a gap, not as a confident zero.
- Offline queue drain age-bounded, so stale destructive commands no longer
- S-53 — the cron guard fails closed on an unset
CRON_SECRET. - The fleet-wide audit feed was dead: two provisioning bugs, one per cohort.
- A unique-constraint failure now names the collision instead of failing opaquely.