• fix(auth): repair invitation claim and bounded feedbacklatestno API changesDocsaa1b4cd2026-10-11 15:13
• feat(auth): add bounded developer credentials for local runs (#868)1Docs9a5d6782026-10-10 14:07

  Change detail

  1 change across 1 operation

  AllBreakingWarningInfo

  • POST/api/v1/auth/oidc/{provider}/start
    • breaking

      removed the x-extensible-enum value claim of the request property purpose

• feat(auth): claim invitations with an external identity (#610)220Docs533428b2026-10-08 11:33

  Change detail

  22 changes across 14 operations

  AllBreakingWarningInfo

  • POST/api/v1/auth/cli-reauth/start
    • info

      added the new optional request property developer_credential

    • info

      added subschema #1 subschema #2 to the request body anyOf list

    • info

      added the new developer-credential enum value to the request property purpose

    • info

      added the new developer-credential.mint enum value to the request property operation

  • GET/api/v1/auth/cli-reauth/transactions/{state}
    • warning

      added the new developer-credential enum value to the purpose response property for the response status 200

    • warning

      added the new developer-credential.mint enum value to the operation response property for the response status 200

    • info

      added the optional property developer_credential to the response with the 200 status

  View all changes (22)
• feat(access): implement per-key member access cards (#856)2Docs77593ea2026-10-06 00:34

  Change detail

  2 changes across 2 operations

  AllBreakingWarningInfo

  • POST/api/v1/orgs/{org}/projects/{project}/environments/{environment}/values/{key}/initialize
    • info

      endpoint added

  • POST/api/v1/orgs/{org}/rules/replace
    • info

      endpoint added

• feat(auth): add local email signup and mailer ceremonies (#849)4Docs5c3f9692026-10-02 18:37

  Change detail

  4 changes across 4 operations

  AllBreakingWarningInfo

  • POST/api/v1/auth/signup
    • info

      endpoint added

  • POST/api/v1/auth/signup/verify
    • info

      endpoint added

  • GET/api/v1/instance/mail
    • info

      endpoint added

  • POST/api/v1/instance/mail/test
    • info

      endpoint added

• feat(auth): add GitHub OAuth2 sign-in and provider administration (#848)17Docs4a22dad2026-10-02 12:25

  Change detail

  17 changes across 13 operations

  AllBreakingWarningInfo

  • GET/api/v1/auth/methods
    • info

      added the optional property providers/items/profile to the response with the 200 status

    • info

      removed the google enum value from the providers/items/brand response property for the response status 200

    • info

      removed the microsoft enum value from the providers/items/brand response property for the response status 200

  • PUT/api/v1/instance/registration-policy
    • info

      added subschema #1 subschema #2 to the external/items request property anyOf list

    • info

      added subschema #1 subschema #2 to the external/items response property anyOf list for the response status 200

  • PUT/api/v1/orgs/{org}/registration-policy
    • info

      added subschema #1 subschema #2 to the external/items request property anyOf list

    • info

      added subschema #1 subschema #2 to the external/items response property anyOf list for the response status 200

  View all changes (17)
• fix(security): remediate DeepSec findings (#844)1420Docsc3dbfac2026-10-02 07:39
• fix(web): offer key declaration only to callers who may declare (#840)4Docscebc7d42026-09-29 16:56
• Member access rules: narrowed grants with rule-local excepts (backend, API, CLI, web) (#838)2,155Docsb7bf6192026-09-29 04:05
• Add generic file-sync destination: client-pull atomic file rendering (#830)9Docs85c0d492026-09-28 05:27
• Add GitLab CI/CD variable deployment adapter (#829)61Docs316c9e02026-09-28 03:59
• feat(adapter): add AWS Secrets Manager synchronization (#828)268Docs20fb9b52026-09-28 02:28
• feat(access): backend for approval-mediated temporary access (#152) (#827)12Docs98b5ef32026-09-28 01:27
• feat(transit): add versioned cryptographic operations (#826)15Docsebd2d2f2026-09-28 00:01
• feat(pki): private PKI core, storage, authorization and lifecycle service (#154) (#825)26Docs8e1c7342026-09-27 22:52
• feat(adapter): Vault/OpenBao KV v2 sync provider (#162) (#823)no API changesDocsd118f0b2026-09-27 21:29
• feat(adapter): Cloudflare Workers and Pages synchronization adapter (#161) (#822)268Docs4460e822026-09-27 19:11
• feat(sshca): OpenSSH user certificate core and KRL encoder (#155) (#824)17Docsba099432026-09-27 14:29
• feat(adapter): sealed webhook receiver protocol and adapter (#163) (#821)no API changesDocs7d1d9ce2026-09-27 13:14
• feat: delivery-target reporting (operator + web), truthful Retry-After, push-delivery ADR (#809)3,3544Docsdaa2bd72026-09-26 05:44
• docs(api): one contract for the policy-less reauth refusal33,368Docs660258b2026-09-25 00:12
• fix(api): bound condition type and reason by the Kubernetes grammar, not an enum38236Docs152f3df2026-09-24 05:52
• feat(api): delivery-target report, tombstone and list operations (#788)3,35018Docs56e75112026-09-24 04:56
• fix(auth): address #606 CodeRabbit review findings492Docs7b17de32026-09-24 03:59
• feat(auth): org origin, provider brand, pairwise guard and sign-up e2e (#607)12Docs19524202026-09-23 17:11
• feat(auth): registration switch 00058 and federated sign-up on OIDC (#607)3Docs8f821332026-09-23 16:44
• feat(api): mark every proof-gated operation with x-hikyo-reauth (#606)no API changesDocsa256d8c2026-09-23 16:41
• fix(auth): address #606 registration policy review findings71Docs29ae0a52026-09-23 16:18
• feat(auth): registration policy service, API, CLI and Members editor (#606)10Docs30481f72026-09-23 15:06
• fix(store): make only verified accounts.email a login and uniqueness key (#605)2Docs48486682026-09-23 13:57
• fix(auth): address #605 review findings1Docs7f322e42026-09-23 13:27
• feat(store): repurpose accounts.email as the verified login email (#605)21Docse7f492a2026-09-23 12:39
• feat(auth): enforce second factor at sign-in; Storybook OpenPencil + Button/Icon fixes (#756, #757, #760) (#786)5Docs76f77922026-09-22 05:51
• fix: address 2026-09-17 codebase adversarial review findings (#778)3Docs8d02fde2026-09-18 11:02
• fix(#744): adapter conflict accumulation + audit trail 500, empty pages, and filter upgrades (#746)12Docs580fa822026-09-15 08:21
• feat(upgrade): add opted-in container upgrades and maintenance UI (#737)1Docs106bc872026-09-13 23:06
• feat: enable secure preview automation (#721, #722, #723, #725, #730) (#731)11Docsda5a2c72026-09-12 23:34
• feat(config): manage runtime settings and controlled bootstrap rollouts (#686)11,308287Docs10aee1a2026-09-06 21:11
• feat(web): use readable names and edit account profiles (#685)15Docs72f5a712026-09-06 08:51
• feat(web): complete audited API-backed behaviours (#680) (#684)29Docscbed2f52026-09-06 08:00
• Merge commit from fork2Docs3700a0e2026-09-05 20:47
• feat(ops): expose verified recovery and storage diagnostics (#673)1Docs549726d2026-09-05 15:20
• Merge pull request #645 from Hikyo-Org/codex/1.0-upgrade-safety226Docs373910c2026-09-05 02:34
• chore: merge verified pre-freeze changes into upgrade governance1262Docs4273c102026-09-05 01:27
• fix(api): keep evolving response discriminators open (#79)226Docs1d4735f2026-09-05 00:48
• fix(auth): close pre-freeze identity and authorization changes #6176419Docsb7e8f322026-09-05 00:17
• fix(upgrades): retire unsafe apply and lock compatibility governance #638no API changesDocs25b16802026-09-05 00:12
• Prove and document full WebUI parity (#504) (#600)1Docsf8033882026-09-02 21:42
• Secret-change approvals: policy-bound review and merge #151 (#594)1026Docsba90c202026-09-02 17:47
• Multi-platform synchronization: targets, filters, health, and control (#157) (#592)Docs94d27a52026-09-02 16:50

Revisions go back to the API's first capture.