Skip to content
Ironflow

Ironflow v0.24.0

Ironflow v0.24.0 ships the DB-backed capacity system — a complete rewrite of how push and pull workers are admitted, fenced, and scheduled — alongside circuit breaker state migrated to the database for cluster-safe consistency, and a set of targeted security and reliability fixes.

Breaking Changes

Section titled “Breaking Changes”
  • PENDING run status retired: runs now enter WAITING (capacity queue) rather than PENDING before execution. Clients checking for PENDING should update to WAITING (#1225)
  • Proto fields dropped: several capacity-related proto fields removed in the clean-break (#1221); regenerate client stubs with make proto

Features

Section titled “Features”
  • DB-backed capacity system (ADR 0037): push and pull workers are now admitted through a database-backed queue with round-robin fairness, execution fencing, session-expiry scanning, and lease lifecycle management (#1206 T7–T14, #1207–#1217, #1221–#1227, #1229–#1230, #1235, #1242, #1245)
  • Circuit breaker → database: circuit breaker state migrated from NATS KV to circuit_breaker_states table, making breaker state consistent across cluster nodes (#1231)
  • Capacity observability: metrics, audit events, and structured alerts for queue activity (#1232)
  • Capacity admin CLI + REST: ironflow circuit-breaker admin commands and REST endpoints for capacity management (#1235)
  • SDK fence-echo: REST worker fence-echo protocol for capacity pull workers (#1215)
  • Dashboard: run list gated on capacity-native WAITING states; dev-mode auth-disabled indicator in sidebar (#1205, #1227)

Fixes

Section titled “Fixes”
  • Security: credential headers redacted in request inspector buffer (#1236)
  • RBAC: self-lockout preflight fails closed on CEL eval error instead of allowing the operation (#1244)
  • Outbox: next_retry_at stamped from the DB clock on PG, eliminating app↔DB clock-skew dispatch delays (#1250)
  • Capacity: cancelled circuit-breaker probe now released immediately (#1248)
  • Capacity: execution_seq staleness enforced at ActivateLease chokepoint (#1245)
  • Capacity: single-probe circuit breaker enforced via stored half_open state (#1247)
  • Capacity: push retry responsiveness restored (dispatcher kick on capacity release) (#1229)