Skip to content
Ironflow

Ironflow v0.20.1

Major release between v0.20.0 → v0.20.1. Lands the #753 Ironflow Cloud GTM pivot (monorepo collapse + closed-source + cluster-per-customer), the #797 CEL policy stack (two-layer authz with tenant-edit-time policies + audit hash chain), the #766 SUB-4 meta-cluster infra wave (Hetzner + Cloudflare TF + bootstrap saga), and a long tail of engine decomposition (#665, #715, #743, #741, #724) finishing characterization-test-gated refactors.

Breaking / Strategic

Section titled “Breaking / Strategic”
  • Monorepo collapse — apps/, sdk/, and brand/ consolidate into a single private monorepo per ADR 0014 (#785).
  • ee/ enterprise split removed (#786) — Closed-source pivot supersedes the public/EE split.
  • GTM pivot plan landed (#784) — Closed-source, cluster-per-customer SaaS; _internal/strategy/2026-cloud-gtm.md.

Features

Section titled “Features”

CEL Policies (Phase 1)

Section titled “CEL Policies (Phase 1)”
  • Policy schema migrations 026-029 + PG hash-chain trigger (#802)
  • CEL evaluator package + audit hash chain + batcher (#799)
  • JWT path subject-aware AuthzRequest re-plumb (#798)
  • Policy handler split + dry-run + versions + templates + self-lockout preflight (#804)
  • CEL policy epoch — NATS layered cache invalidation + PG fallback (#805)
  • CLI policy commands — update/test/versions/rollback/template + bypass (#806)
  • Dashboard CEL policies UI — decompose, dry-run, history, templates (#803)
  • ADR 0016 + explainer + how-tos + runbooks (#801)
  • CEL chaos tests + k6 policy-eval + R1/R2/R3 regressions (#810)

Meta-cluster Infrastructure (#766 SUB-4)

Section titled “Meta-cluster Infrastructure (#766 SUB-4)”
  • Cloudflare zone + wildcard DNS-01 cert (OpenTofu) — Wave 1 / Lane B (#824)
  • Meta-cluster TF + cloud-init bootstrap — Wave 1 / Lane C (#825)
  • Operator + bootstrap + smoke scripts (bash + bats) — Wave 1 / Lane D (#826)
  • xcaddy build + Sigstore + GitHub Release artifact — Wave 1 / Lane E (#828)
  • Validate + drift + weekly cold-restore drill — Wave 2 / Lane F (#829)
  • Meta-cluster runbook + ADR 0017 + .env.example + make infra-apply — Wave 2 / Lane G (#830)
  • tmpfs handoff for first-boot admin key — closes journalctl + stdout leak channels (#832)
  • BOOTSTRAP_ADMIN_KEY_ISSUED log event (#823)

Distribution + Licensing

Section titled “Distribution + Licensing”
  • Distribution + license policy (#811)
  • License-rot + dashboard isEnterprise gate cleanup (#812)
  • Marketing rewrite + /license page — Group C (#813)

Engine Decomposition (gated by drift tests)

Section titled “Engine Decomposition (gated by drift tests)”
  • #665 Candidate 0 — bootstrap ADR process (#667)
  • #665 Candidate 1 — Store partition into 10 sub-interfaces + per-domain file split + drift gate (#669, #670, #674, #678, #679)
  • #665 Candidate 2 — Engine decomposition: char-tests, dispatch pkg, EventRouter/StepManager/PushExecutor/PullDispatcher refs cut (#685–#695)
  • #665 Candidate 3 — Event lifecycle seam + SubjectCodec + codec error counters (#701–#708)
  • #665 Candidate 4 — eventtrigger env-scoped idempotency + UNIQUE migration (#665 PR 7-9/N)
  • #665 PR 8/8 — EngineMutator/Notifier complete, worker_rest migration, getters deprecated (#720–#727)
  • #715 invokeOrchestrator extraction + REST migration (#738–#742)
  • #741 sleep/wait yield orchestration unified (#744, #746)
  • #743 jobOrchestrator extraction + REST job-completion gate (#748–#750)
  • #745 gRPC step handlers migrate to canonical raw stepID + YieldOrchestrator delegation (#747)
  • #724 optimistic CAS wired into PauseRun/ResumeRun/InjectStepOutput (#731, #734)

Fixes

Section titled “Fixes”
  • Atomic event+run + invoke idempotency (#736) — closes #714, #728
  • REST + Connect cancel/resume semantics unified (#735) — closes #716
  • InvokeFunction async dispatch bounded on shutdown (#729) — closes #717
  • ClaimRunsReadyToRetry scan drift — missing cancellation_cause (#760)
  • Engine drain detached dispatch goroutines on Stop (#756) — closes #732
  • Cross-tenant org CRUD gap closed — #660 SUB-3 PR2 (#818)
  • Platform login cookie Secure flag behind TLS proxy (#763)
  • Events table keyset pagination (#698)
  • Postgres outbox batch INSERT (#690)
  • OrgPicker scoped to caller (#662)
  • Projection tableName quoted — closes SQL injection vector (#688)
  • Three Postgres quirks from #670 review (#696)
  • Resolve $KUBECONFIG + preflight cluster reachability (#658)

Build / CI

Section titled “Build / CI”
  • linux-arm64 cross-compile + CI smoke — #765 SUB-3 PR1 (#817)
  • Unbreak make ci — bootstrap.Run signature, h2c lint, zod dedup, coverage gate (#836)
  • Coverage gate: unskip 5 packages from 80% gate (#816)
  • codecdrift Go-AST drift gate (#704)
  • Drift gate wired into make ci + ADR 0008/0010 Accepted (#727, #742)

Documentation

Section titled “Documentation”
  • All 19 runbooks surfaced in Docusaurus Platform → Runbooks (was 8/19) (#833)
  • State-of-ironflow refresh for v0.20.0 + agent-runtime pivot (#655, #656)
  • Repository structure section + ASCII monorepo tree in README
  • Hatchet comparison tables (#663)
  • Future Ideas section with 10 indie-dev apps (#657)