Tags give the ability to mark specific points in history as being important
-
v0.18.0
protectedRelease: v0.18.0be04a1ef · ·release: v0.18.0 — convert declared nested schemas at the React client wire boundary (L-59, L-60) The React client's camelCase<->wire mapper consulted its key table only for the object it was handed and dropped it on every recursive call. Declared nested schemas therefore crossed the wire in camelCase while the generated Go server binds the declared wire names, and inbound wire names were never normalized to the camelCase the emitted TS interfaces promise. REST bodies, WebSocket messageSchema frames and GraphQL variables/results all share that mapper. Fixed in both directions for both shapes that reach a declared schema: * array-of-$ref nested schemas (L-59) * additionalProperties map VALUES, whose map KEYS remain data and are never rewritten (L-60) The converters are now schema-directed rather than depth-limited: each field carries a composable descent descriptor -- a schema name prefixed by one "{}" per map level -- so one recursion covers arrays, maps, arrays of maps and maps of maps alike. MINOR rather than PATCH despite the conventional-commit type: generated map types narrow from Record<string, unknown> to Record<string, T>, which can fail a downstream typecheck, and inbound nested keys now arrive camelCase as the emitted interfaces always declared. Free-form and additionalProperties-shaped DATA keys are unaffected: anything with no declared schema to descend into produces an empty descriptor and passes through verbatim, preserving G-08. Reported independently downstream as a list endpoint rendering "0 of 0" from a healthy 200 -- the envelope's own key map was a no-op, so the top level appeared to convert while every row was copied verbatim and a consumer guard discarded them all. See docs/GENERATOR_BUGS.md L-59 and L-60. -
v0.17.2
protectedRelease: v0.17.2d9a12188 · ·release: v0.17.2 — correct the MCP rate/burst config path in generated comments Fixes CP-227. The comment apic emitted into every generated mcp/tools.gen.go told operators to configure the MCP tool rate limiter under security.MCP.Rate / MCP.Burst. That path does not exist and is hard-rejected by apic's own loader: unknown object member name "mcp" within "/security" MCPConfigSection binds at the config root, so the working path is the top-level mcp.rate / mcp.burst. The feature was always correct -- only the guidance was wrong, and because it shipped inside generated code it read as authoritative to the downstream developer. Reported by devnw.dev/mail while closing GAP-009. No runtime behavior changes. The emitted comment now names the real path and carries a copy-pasteable literal: {"mcp": {"rate": 60, "burst": 60}} Also closes the defect class, not just the instance. Nothing checked prose shipped inside generated output -- not the generator's tests, not the consumer's compiler -- which is why this shipped since GEN-2026-05-29-06. cmd/apic/config_path_doc_test.go now resolves every config path cited in an emitted Go comment against the real Config schema, via a resolver mirroring the loader's decode rules (json tags, embedded promotion, and the outer-shadows-embedded rule that makes Config.MCP win over RuntimeConfig.MCP). The report's optional hardenings -- a security.mcp alias and a better rejection message -- were deliberately not taken: both change loader behavior, which is beyond a documentation defect. -
v0.17.1
protectedRelease: v0.17.185dfbb5c · ·release: v0.17.1 — CI test-timeout fix for the v0.17.0 hardening release v0.17.0's tag pipeline was killed at exactly 1500.258s in cmd/apic (a cold cache pushed it past -timeout 25m), which skipped every downstream stage including the apt publish. No code changed; the test timeout is raised to 45m. Carries the full v0.17.0 payload: twelve rounds of adversarial appsec and quality review closing ~130 findings, 8 of them High — generator code injection, composite-auth routes emitting no CSRF or admin authorization, a revoked CAC authenticating, a path-parameter IDOR, and a WebAuthn credential-ID collision enabling account takeover.
-
v0.17.0
protectedRelease: v0.17.0214096f9 · ·release: v0.17.0 — audit round-5 security hardening Twelve rounds of adversarial appsec and quality review closed ~130 findings, including 8 High: - generator code injection: a schema pattern, and enum values reaching the MCP tool InputSchemaJSON, escaped their Go string literals; one payload injected a working func init() into always-emitted code that parsed clean, defeating the go/parser backstop a prior audit had relied on - composite-auth routes emitted zero CSRF enforcement and zero admin authorization (one root cause: op.Auth carries a whole boolean expression and every security predicate compared it by exact string) - mtls.crl/ocsp/cac_piv were parsed but emitted nowhere, so a REVOKED CAC authenticated. Revocation is now genuinely enforced, with the OCSP response bound to the leaf serial, the responder authorized by id-kp-OCSPSigning, CRL scope and freshness checked, and the cache bound to the issuer key - a path parameter absent from requestSchema was supplied by the request BODY rather than the URL (IDOR / mass assignment) - a WebAuthn credential-ID collision permitted discoverable-login user confusion and permanent credential overwrite Notable behavior changes (see docs/MIGRATION_*.md): - /admin routes whose composite auth has an OR-group with no identity leaf now FAIL generation instead of silently emitting no authorization - the generated Go client returns ([]byte, error) for binary routes - httpx.RouteLimiter reports post-admit X-RateLimit-Remaining - wsx.Conn.WithContext and securex.StartNonceGC gained deprecation shims Verification: 39/39 configs generate, build, lint and BOOT; govulncheck clean; 27 fuzz targets; full pipeline green including fips, hsm, and generate:drift.
-
v0.15.0
protectedRelease: v0.15.0b02e0f43 · ·v0.15.0 Minor release (0.14.5 -> 0.15.0). Highlights since v0.14.5: - Default-on OTEL observability, W3C trace-context + correlation propagation, structured logging with lumberjack rotation, and a generated health subsystem. - Polyglot client trace/correlation propagation (Python/Rust/Zig/TS) + MCP transport gating. - Security hardening: redaction of secret fields + bounded recursion, N-P3-3 sensitive-path guards, control-plane route-collision validation, per-handshake TLS rotation. - Generated TS client wire-key fixes (empty-schema camelCase, path-param request-type fields, schema-aware WebSocket send) across Go/Python/Rust/TS. - apic Claude Code plugin (/apic:mcp, observability-health-contract skill, config reference).