v1.5.0Latest
Remediation of the Trust-Zero exhaustive audit. All P0 and P1 findings closed.
Security
Security- Cross-tenant IDOR closed (30 routes). resolve_workspace_id returned the client's workspace_id query parameter verbatim while the authority guard validated the X-Workspace-ID header, letting a member of one workspace read another's cognition-cost data. The workspace now comes from the verified AuthorityContext; a mismatched parameter is rejected with 403.
- RLS bypass authorization guard restored. is_worker_or_test_context() tested celery.current_task is not None; that object is a Proxy and is never None, so the guard — and the production hard-block that depends on it — passed unconditionally in every process.
- Authority cache integrity is now keyed. The AuthorityContext Redis entry was "validated" with an unkeyed SHA-256 over its own fields, which anyone able to write the cache could recompute. Replaced with HMAC over SECURITY_SALT, compared in constant time.
- Policy evaluation fails closed. A constitutional_policies outage previously fell back to tier >= 1, authorising every action for every member including APPLY_FIX and ROLLBACK_FIX.
- Encryption context is verified, not trusted. The context embedded in a ciphertext overwrote the caller's, so a credential blob copied between workspaces decrypted successfully. It is now checked against the active workspace.
- Privileged database roles no longer auto-approved by hostname. Requires an explicit ALLOW_PRIVILEGED_DB_ROLE opt-out instead of inferring consent from a managed-provider DNS name.
- WebSocket sessions honour deprovisioning — SCIM blacklist and soft-delete tombstone are now checked at handshake.
- Onboarding IAM template split into ArthaOpsCostIntelligenceReadOnly and an optional ArthaOpsRemediationActions; destructive EC2 permissions are no longer bundled into a policy named "Minimum Cost Intelligence".
- Stripe webhook verification fails closed when the SDK is unavailable; staging now rejects unsigned webhooks like production.
Fixed
Fix- Staging booted with every production guard disabled. StagingSettings overrode the parent pydantic validator by name with return self, silently disabling the entire fail-fast block including allow_insecure_dev_auth = False.
- Workspace authority deadlock. workspace_members.role carried three disjoint vocabularies compared with ==; the workspace creator (OWNER, tier 1) was locked out of member management, secrets and autopilot, and no one could reach the Tier 3 required to execute a fix. Unified onto a single ranked ladder with a DB CHECK constraint and an ORM normaliser.
- Celery safety limits were inert. Under the threads pool, time_limit, soft_time_limit, max_tasks_per_child and max_memory_per_child are all ignored. Default pool is now prefork, with a boot-time assertion in production and staging.
- Scan dispatch race. autopilot_scan_cycle dispatched Celery tasks before committing the rows they referenced, incremented a billing counter with a lost-update-prone read-modify-write, and rolled back a whole batch on a single failure.
- Worker container crash loop. A Redis credential failure raised at module import, making the image unbootable with no /health and no diagnostics. Import-time code now degrades; the startup validator renders the deploy-blocking verdict.
- Redis auth failures were misreported as certificate failures and retried against every CA bundle.
- `MissingGreenlet` on seven economics routes driving AsyncSession.sync_session synchronously.
- `ModuleNotFoundError: lz4` could take down the whole process from a cache-compression import.
- Secret-rotation warning emails reached nobody — the recipient query filtered on lowercase roles.
- Founder console under-reported every figure ≥ ₹10L by 10× (divided by ten lakh, labelled "L").
Changed
Changed- All 117 naive DateTime columns are now DateTime(timezone=True), with migration a7c3e1d9f5b2 converting the database to timestamptz — completing the Temporal Sovereignty mandate for the JIT elevation window, the financial ledger, FX provenance and the events_raw pipeline.
- localize_amount() routes through get_sovereign_fx_rate() instead of a second, static FX constant.
- A BASELINE_CONSTITUTION governs workspaces that have not ratified their own policy set, resolving the default-DENY bootstrap deadlock on APPLY_FIX / ROLLBACK_FIX.
Governance
Governance- Coverage ratchet restored to 53% (measured 53.86%). It had been moved 53 → 70 → 50 within 30 minutes on 2026-08-03, ending below its prior value in violation of the file's own increase-only rule.