Skip to content
ironflow

Ironflow v0.36.0

Ironflow v0.36.0 hardens the RBAC and inspector security surface, closes several projection and event-wait correctness gaps, and rounds out span-level observability across the Connect and gRPC transports.

Features

Section titled “Features”
  • Hot patching is now an engine mutation; the transport-layer half of #724 closes with it (#2140)
  • cmd/cloud’s HTTP surface is traced and measured (#2119)

Fixes

Section titled “Fixes”
  • Impersonation now classifies read vs write by the RBAC action, not the HTTP verb (#2132)
  • RBAC charges the read action for three body-carrying REST reads (#2091)
  • RBAC anchors connectAction and reads the router’s path in every pre-route gate (#2077)
  • The inspector’s response capture buffer is bounded, and it no longer stores credentials (#2118)
  • Store error text no longer reaches wait callers on any route (#2137)
  • A projection poller that exits without teardown is now deregistered, not left as a corpse (#2136)
  • A subscribe that never gets an ack no longer leaves a channel dark (#2133)
  • A shed gRPC or gRPC-Web write no longer counts as a success (#2129)
  • InjectStepOutput reports CAS exhaustion as retryable, and a reason header splits the two meanings of aborted (#2128)
  • InjectStepOutput’s run-precondition window on the live RPC path is closed (#2078)
  • One middleware chain now covers all three entry points; write-throttle caps ship off (#2124)
  • A remote traceparent no longer chooses the sample rate (#2125)
  • PauseRun answers CodeFailedPrecondition for a terminal-state pause (#2109)
  • WaitForEvent’s publish-pending poll is priced, coalesced, and bounded (#2103)
  • Partitioned catch-up waits read the partition cursor, not the aggregate (#2102)
  • Upcast dry-run version spans are bounded across transports (#2099)
  • runs.version is a real CAS guard; the two cancel paths it broke are repaired (#2080)
  • The SDK discriminates the two 409s on the Connect code, not the status (#2076)
  • A capacity spike’s throwaway Postgres tables are dropped on cleanup (#2116)
  • Bootstrap writes the admin key file before the row that accepts it (#2062)
  • Bootstrap: a stranded .tmp no longer blocks future key writes (#2051)
  • Bootstrap reports the persisted key’s prefix when the insert loses the race (#2047)
  • Customer-cluster provisioning speaks the engine’s actual API (#2049)

Improvements

Section titled “Improvements”
  • The ADR 0008 engine↔server seam is finished; duplicate REST routes are removed (#2055)
  • Partition wait fan-out is bounded, and the projection poller is scoped per environment (#2101)
  • The projection waiter cap gets a per-org sub-cap (#2100)
  • Throttled RPCs are named on their spans (#2122)
  • rpc.system/rpc.service/rpc.method are set on Connect server spans (#2111)
  • The @ironflow/gen JS barrels are generated from make proto, and all 13 _pb modules are re-exported and gated (#2126, #2123)