/////PUBLIC CHANGELOG

[5.5.0]

PUBLIC ENGINEERING CHANGELOG

Product Release Velocity & Updates

Every release of ArthaOps, generated directly from the engineering changelog. Currently shipping 5.5.0.

Current Release5.5.0PRODUCTION LATEST

Active Detectors378 ActiveAWS • AZURE • GCP • K8S

Invariant Tests13,032 Tests100% GATES PASSING

Security Posture0 Known CVEsNIST SP 800-218 PINNED

v5.5.02026-09-14Latest

Added

Feature

7-Layer Causality Depth Taxonomy (L1–L7): Extended ArchitecturalDepthLayer in the causality engine with L6_PREDICTIVE (workload trend and seasonal rightsizing) and L7_AUTONOMOUS (bounded closed-loop self-healing and automated elasticity). Bound blast radius derivations (L6 is ZERO under R0; L7 is MEDIUM under R0, HIGH under R1–R3).
TokenGuard Developer AI Economics Protocol: Added TokenGuardEngine and fast POSIX hook to extract AI coding agent telemetry (Claude Code, Cursor) under a hard zero-prompt-leakage privacy invariant (audit_privacy_integrity), failing closed on corrupt schemas and computing costs in integer paise minor units.
Multi-Cloud OCI Read-Only FinOps Suite: Added 3 native Oracle Cloud Infrastructure detectors (OciFlexComputeOversizingDetector, OciUnattachedBootVolumeDetector, OciAutonomousDbWeekendIdleDetector). Gated strictly as advisory non-executable actions (is_adapter_action(action) is False).
AWS Organization Cross-Account Commitment Rebalancing: Added multi-account commitment capacity pooling to dynamically balance reservations across member accounts during demand dips, with automated simulation safeguards and selective account isolation.

Verified

Changed

Validated causality layers, developer token economics, multi-cloud detection, and organization rebalancing suites.
Certified formal mathematical verification and local pre-push fast gates PASS 100% GREEN.

v1.5.02026-08-04

Remediation of the Trust-Zero exhaustive audit. All P0 and P1 findings closed.

Security

Cross-tenant IDOR closed (30 routes). resolve_workspace_id returned the client's workspace_id query parameter verbatim while the authority guard validated the X-Workspace-ID header, letting a member of one workspace read another's cognition-cost data. The workspace now comes from the verified AuthorityContext; a mismatched parameter is rejected with 403.
RLS bypass authorization guard restored. is_worker_or_test_context() tested celery.current_task is not None; that object is a Proxy and is never None, so the guard — and the production hard-block that depends on it — passed unconditionally in every process.
Authority cache integrity is now keyed. The AuthorityContext Redis entry was "validated" with an unkeyed SHA-256 over its own fields, which anyone able to write the cache could recompute. Replaced with HMAC over SECURITY_SALT, compared in constant time.
Policy evaluation fails closed. A constitutional_policies outage previously fell back to tier >= 1, authorising every action for every member including APPLY_FIX and ROLLBACK_FIX.
Encryption context is verified, not trusted. The context embedded in a ciphertext overwrote the caller's, so a credential blob copied between workspaces decrypted successfully. It is now checked against the active workspace.
Privileged database roles no longer auto-approved by hostname. Requires an explicit ALLOW_PRIVILEGED_DB_ROLE opt-out instead of inferring consent from a managed-provider DNS name.
WebSocket sessions honour deprovisioning — SCIM blacklist and soft-delete tombstone are now checked at handshake.
Onboarding IAM template split into ArthaOpsCostIntelligenceReadOnly and an optional ArthaOpsRemediationActions; destructive EC2 permissions are no longer bundled into a policy named "Minimum Cost Intelligence".
Stripe webhook verification fails closed when the SDK is unavailable; staging now rejects unsigned webhooks like production.

Fixed

Fix

Staging booted with every production guard disabled. StagingSettings overrode the parent pydantic validator by name with return self, silently disabling the entire fail-fast block including allow_insecure_dev_auth = False.
Workspace authority deadlock. workspace_members.role carried three disjoint vocabularies compared with ==; the workspace creator (OWNER, tier 1) was locked out of member management, secrets and autopilot, and no one could reach the Tier 3 required to execute a fix. Unified onto a single ranked ladder with a DB CHECK constraint and an ORM normaliser.
Celery safety limits were inert. Under the threads pool, time_limit, soft_time_limit, max_tasks_per_child and max_memory_per_child are all ignored. Default pool is now prefork, with a boot-time assertion in production and staging.
Scan dispatch race. autopilot_scan_cycle dispatched Celery tasks before committing the rows they referenced, incremented a billing counter with a lost-update-prone read-modify-write, and rolled back a whole batch on a single failure.
Worker container crash loop. A Redis credential failure raised at module import, making the image unbootable with no /health and no diagnostics. Import-time code now degrades; the startup validator renders the deploy-blocking verdict.
Redis auth failures were misreported as certificate failures and retried against every CA bundle.
`MissingGreenlet` on seven economics routes driving AsyncSession.sync_session synchronously.
`ModuleNotFoundError: lz4` could take down the whole process from a cache-compression import.
Secret-rotation warning emails reached nobody — the recipient query filtered on lowercase roles.
Founder console under-reported every figure ≥ ₹10L by 10× (divided by ten lakh, labelled "L").

Changed

All 117 naive DateTime columns are now DateTime(timezone=True), with migration a7c3e1d9f5b2 converting the database to timestamptz — completing the Temporal Sovereignty mandate for the JIT elevation window, the financial ledger, FX provenance and the events_raw pipeline.
localize_amount() routes through get_sovereign_fx_rate() instead of a second, static FX constant.
A BASELINE_CONSTITUTION governs workspaces that have not ratified their own policy set, resolving the default-DENY bootstrap deadlock on APPLY_FIX / ROLLBACK_FIX.

Governance

Coverage ratchet restored to 53% (measured 53.86%). It had been moved 53 → 70 → 50 within 30 minutes on 2026-08-03, ending below its prior value in violation of the file's own increase-only rule.

v1.4.02026-07-17

Added

Feature

Simulated Scan RegionState Reconstruction: Restructures the simulated scan engine to dynamically reconstruct region state from raw telemetry events, enabling pure detectors to execute correctly in simulation.
Optimistic Locking on AutopilotConfig: Deployed version-based optimistic locking on AutopilotConfig database model to prevent last-write-wins concurrency race conditions.

Security & Hardening

Security

Launch Gate Vulnerability Remediation: Hardened connection pool advisory lock retention, database row-level security isolation checks for background workers, and AWS Account ID onboarding input sanitization.
Integer-Based Monetary Storage (Paise/Cents): Deployed integer-based BigInteger representation for all monetary fields across 9 models, preventing float representation inaccuracies.

v1.3.02026-07-09

Testing & Reliability

Reliability

Test-Suite & Database Stabilization (Phase 5.5): Resolved database isolation, SQLite transactional locks/contention, and state pollution leaks across full-suite test runs.
Deterministic Hypothesis Execution: Configured deterministic execution parameters without persisted example replay, eliminating test deadlocks.

v1.2.02026-06-19

Added

Feature

Observability Baseline (P0-B2): Complete DB-free Prometheus telemetry metrics (/metrics endpoint cached in Redis via Celery Beat). Instrumented HTTP request counts/latencies, rolling latency window percentiles (p50/p95/p99), database connection pool waiting/exhaustion stats, and Celery task durations/retries.
Wave 0 Hygiene & Quick Wins: Moved non-pytest proof scripts to validation directories. Created MIT LICENSE and CONTRIBUTING.md. Hardened .gitignore and .github/workflows parallel build checks.
Disaster Recovery (P0-S2): Formally established and documented recovery runbooks (pg_restore playbooks, RPO=1h, RTO=4h targets) under docs/runbooks/.

Fixed

Fix

Async Concurrency & ORM Safety (P0-B1-B, P0-B1-D): Enforced lazy="raise" globally across all SQLAlchemy models. Converted all core services (Policy, Adjudication, Simulator) to native asyncio AsyncSession context to eliminate multithreaded session collisions.
SlowAPI Python 3.14 Compatibility: Fixed slowapi NameError exception handler syntax block for modern Python.

v1.1.02026-06-16

Added

Feature

Multi-Constraint Remediation Scheduler: Deployed advanced multi-constraint optimization scheduler maximizing priority value subject to daily and cycle risk budgets.
Controlled Automated Remediation: Deployed concrete infrastructure adapters for governed execution, gated by multi-approval audit trails.
Trust Validation Scheduler: Scheduled validation sweeps to verify outcome accuracy of executed fixes after 20 hours.
Statistical Confidence Calibration: Statistical confidence calibration engine with dynamic smoothing for findings accuracy estimation.
Namespace Deep Waste Scoring: Granular pod resource/cost metrics and trends for Kubernetes namespaces.

v1.0.02026-05-12

Added

Feature

Production Baseline Launch: Hardened FastAPI 0.136 and Next.js 14 stack for production deployment on Vercel and AWS EC2.
Payment & Autopilot Billing: Dual-validation Razorpay payments loop with Growth, Autopilot, and Enterprise subscription tiers.
Logto Enterprise Auth: Integrated Logto JWT auth with joserfc signature cache layer.
Trust & Compliance UI: Deployed Trust Banners (Cost Freshness, Limited Visibility) and a forensic Trust Dashboard rendering signed cryptographic hashes of scan outcomes.

v0.9.02026-04-24

Added

Feature

Fix engine certified against live AWS (Elastic IP release, all 3 verification checks pass).
Full registry smoke test covering all 219 detectors (94.3% pass rate on live AWS).
Session-start hook: auto-loads agent memory context at every Claude Code launch.

Fixed

Fix

3 float .quantize() bugs in ec2-15, iam-03, obs-02 — deferred post-launch.

v0.8.02026-04-20

Added

Feature

Revenue loop: Scan → Find → Fix → Pay wired end-to-end.
Razorpay checkout integration.
Plan-tiered policy gate (Free / Pro / Enterprise).
Savings Guard cap enforcement.

v0.7.02026-04-15

Added

Feature

Institutional dashboard (Titanium Monolith design system).
Procrastination Simulator (What-If engine).
Safe Mode, Cost Freshness, Limited Visibility trust banners.
Empty state conversion bridge.

v0.6.02026-04-10

Added

Feature

Auth pipeline: Logto → AuthBridge → joserfc JWKS verification.
Multi-account panel.
API Keys management stub.
CloudFormation onboarding template.

v0.5.02026-04-01

Added

Feature

193 AWS cost detectors across 15 service categories.
Tiered Celery scan pipeline (instant + deep).
Calibration engine with hybrid multipliers.
Detection quarantine for confidence < 0.6.

Explore Technical Product Documentation

v1.5.02026-08-04

Remediation of the Trust-Zero exhaustive audit. All P0 and P1 findings closed.

Security

Cross-tenant IDOR closed (30 routes). resolve_workspace_id returned the client's workspace_id query parameter verbatim while the authority guard validated the X-Workspace-ID header, letting a member of one workspace read another's cognition-cost data. The workspace now comes from the verified AuthorityContext; a mismatched parameter is rejected with 403.
RLS bypass authorization guard restored. is_worker_or_test_context() tested celery.current_task is not None; that object is a Proxy and is never None, so the guard — and the production hard-block that depends on it — passed unconditionally in every process.
Authority cache integrity is now keyed. The AuthorityContext Redis entry was "validated" with an unkeyed SHA-256 over its own fields, which anyone able to write the cache could recompute. Replaced with HMAC over SECURITY_SALT, compared in constant time.
Policy evaluation fails closed. A constitutional_policies outage previously fell back to tier >= 1, authorising every action for every member including APPLY_FIX and ROLLBACK_FIX.
Encryption context is verified, not trusted. The context embedded in a ciphertext overwrote the caller's, so a credential blob copied between workspaces decrypted successfully. It is now checked against the active workspace.
Privileged database roles no longer auto-approved by hostname. Requires an explicit ALLOW_PRIVILEGED_DB_ROLE opt-out instead of inferring consent from a managed-provider DNS name.
WebSocket sessions honour deprovisioning — SCIM blacklist and soft-delete tombstone are now checked at handshake.
Onboarding IAM template split into ArthaOpsCostIntelligenceReadOnly and an optional ArthaOpsRemediationActions; destructive EC2 permissions are no longer bundled into a policy named "Minimum Cost Intelligence".
Stripe webhook verification fails closed when the SDK is unavailable; staging now rejects unsigned webhooks like production.

Fixed

Fix

Staging booted with every production guard disabled. StagingSettings overrode the parent pydantic validator by name with return self, silently disabling the entire fail-fast block including allow_insecure_dev_auth = False.
Workspace authority deadlock. workspace_members.role carried three disjoint vocabularies compared with ==; the workspace creator (OWNER, tier 1) was locked out of member management, secrets and autopilot, and no one could reach the Tier 3 required to execute a fix. Unified onto a single ranked ladder with a DB CHECK constraint and an ORM normaliser.
Celery safety limits were inert. Under the threads pool, time_limit, soft_time_limit, max_tasks_per_child and max_memory_per_child are all ignored. Default pool is now prefork, with a boot-time assertion in production and staging.
Scan dispatch race. autopilot_scan_cycle dispatched Celery tasks before committing the rows they referenced, incremented a billing counter with a lost-update-prone read-modify-write, and rolled back a whole batch on a single failure.
Worker container crash loop. A Redis credential failure raised at module import, making the image unbootable with no /health and no diagnostics. Import-time code now degrades; the startup validator renders the deploy-blocking verdict.
Redis auth failures were misreported as certificate failures and retried against every CA bundle.
`MissingGreenlet` on seven economics routes driving AsyncSession.sync_session synchronously.
`ModuleNotFoundError: lz4` could take down the whole process from a cache-compression import.
Secret-rotation warning emails reached nobody — the recipient query filtered on lowercase roles.
Founder console under-reported every figure ≥ ₹10L by 10× (divided by ten lakh, labelled "L").

Changed

All 117 naive DateTime columns are now DateTime(timezone=True), with migration a7c3e1d9f5b2 converting the database to timestamptz — completing the Temporal Sovereignty mandate for the JIT elevation window, the financial ledger, FX provenance and the events_raw pipeline.
localize_amount() routes through get_sovereign_fx_rate() instead of a second, static FX constant.
A BASELINE_CONSTITUTION governs workspaces that have not ratified their own policy set, resolving the default-DENY bootstrap deadlock on APPLY_FIX / ROLLBACK_FIX.

Governance

Coverage ratchet restored to 53% (measured 53.86%). It had been moved 53 → 70 → 50 within 30 minutes on 2026-08-03, ending below its prior value in violation of the file's own increase-only rule.