Ironflow v0.45.0

Ironflow v0.45.0 fixes 54 defects found in a full repository audit. It changes behavior in secrets, environment deletion, sessions, event-sourcing reads, run lifecycle, consumer groups and WebSockets. It also adds a readiness page and a branded ironflow version.

Breaking Changes

• A declared secret that cannot be read now fails the run. The run fails with SECRETS_UNAVAILABLE and the secret’s name, on push, REST pull and streaming pull. Before, one undecryptable secret made the engine drop every declared secret and run the function anyway. A secret that does not exist is still skipped with a warning. The secrets API answers 404 (GET, PATCH) or 204 (DELETE) in an environment with no secrets, not 500. A secret’s created_at is now its first write time (#2865)
• A deleted environment no longer leaks state to the next environment with the same ID. Deleting an environment, project, org or tenant now deletes its NATS KV buckets and purges its PUBSUB messages, consumer-group and projection durables, and pending debounce entries. A new environment whose ID is already taken by another project gets env_<project slug>-<hash>_<name> instead of a 409 (#2864)
• Engine NATS subjects now carry the environment ID: ironflow.{project name}.{env ID}.…, not the environment name. The ingest router still accepts a name from external publishers. During a rolling upgrade, TriggerSync on a new node can wait until its timeout for a result from an old node (#2864)
• Sessions are checked against the current account on every request. Deleting a user, or rotating or deleting the API key behind a desktop session, revokes the session on its next request. Role and email changes apply at once. User role updates validate every role name first and apply in one transaction. An unknown role returns 400. The organization’s last admin cannot lose admin or be deleted (409) (#2872)
• Event-sourcing reads changed. A projection rebuild over StreamProjectionEvents sends each batch once and no longer double-counts events in non-idempotent reducers. from_version is now an inclusive start in the read direction, so backward entity paging no longer repeats the first page. GetEntityHistory.total_events is the stream size on every page. ListProjections.total_count is the number of matching projections (#2870)
• Re-registering a function no longer resumes a paused or archived function. It also no longer bumps the version when the config is unchanged. UpdateFunctionStatus with a missing or unknown status returns InvalidArgument. Integers above 2^53 stay exact in step.invoke input and in the config API (#2869)
• Run lifecycle fixes. waitForEvent matching keeps exact numbers, and an engine-rejected push yield now fails the run with YIELD_REJECTED. TriggerSync returns at once when a run fails or is cancelled outside the executor. Push requests carry the real attempt in attempt and X-Ironflow-Attempt. Cron ORs day-of-month and day-of-week when both are set, and rejects dates that never occur (#2868)
• Consumer groups no longer lose events when a member reads slower than events arrive. UpdateConsumerGroup validates the pattern like CreateConsumerGroup. Replay of the last N events scans back from the newest message. Filtered groups keep events with array or scalar payloads (#2867)
• WebSocket and KV watch fixes. A client disconnect no longer crashes the server with send on closed channel. Unsubscribing a group subscription now leaves the group. With IRONFLOW_WS_ALLOWED_ORIGINS set, SDK clients that send no Origin header can connect again. KV and config watch sockets cap incoming frames at 4 KB (#2866)

Features

• ironflow version prints a branded banner with build info (#2879)
• A per-capability readiness column and a generated readiness page show what is pre-1.0. The docs site carries a pre-1.0 banner, and the release workflow guards the readiness data (#2907, #2908)
• CHANGELOG.md uses one spelling for breaking changes, and the release notes read it (#2910)
• The SDK parity matrix shows status cells as colored chips (#2920)
• The landing page has a Field notes newsletter sign-up (#2911)
• New blog post: a push handler in Rust (#2900)

Fixes

• Environment IDs stay unique across orgs, and deleted environment state is purged (#2878)
• Secrets fail closed when unreadable, and answer “absent” for environments with no secrets (#2881)
• Go SDK: exact step replay, re-register when the server forgot the worker, unencodable output, step timing (#2873)
• SDKs: heartbeats drain, failed-step outputs, unencodable output and upcast failures are handled (#2874)
• Store: a run delete releases its lane slot and worker credit. Webhook lookup prefers the accepted delivery (#2871)
• Dashboard: UTF-8 base64, per-run state, webhook paging, runs past the end of a list, account save order. The analytics page no longer links to a misleading test event (#2875, #2861)
• Cloud: per-customer tofu state, a module variable contract and a create_box compensator (#2876). Per-request dispatch keys, first JWT rotation, resize rollback and subscription.deleted mid-transition (#2877). The onboarding email is skipped when provisioning schedules a deprovision (#2906). subscription.deleted before the cluster is active is honored (#2895). Auto-remediation attempts are capped per cluster (#2896). The deprovision dispatch chains past a cancelled run (#2897)

Improvements

• The docs now match the current implementation after a docs-audit pass (#2882)

Other

• Added the push-pull explainer video (#2880) and the 2026-10-14 repository bug audit report (#2863)
• Ironflow Desktop ships on its own cadence. See the Desktop changelog.