Release notes

v0.1.0 — 2026-09-05

Theme: static API reference, controlled Enterprise demo and portable Enterprise app-ui distribution.

Status: released. Runtime v0.9.8 is the minimum compatible Runtime. api.engineeringruntime.com is the verified static Cloudflare Pages reference, and Cloudflare Access protects app.engineeringruntime.com. The product owner confirmed the Access login followed by the separate Enterprise portal login. Cloud Run public invocation is intentionally open at min zero / max one while the controlled demo is active; app-api independently authenticates every operational route.

Customer-visible changes

• api.engineeringruntime.com becomes a static, read-only API contract and Control Plane release-notes site with no live request execution.
• app.engineeringruntime.com becomes the Access-protected Enterprise UI and independently logs in to the execution-only app-api.
• The same app-ui source preserves that static Cloudflare Pages deployment and additionally produces a separately versioned unprivileged OCI candidate for customer OpenShift, GKE and Kubernetes deployments. app-ui and app-api remain separate images and scaling units. The first candidate records Control Plane v0.1.0, its source SHA and immutable digest; latest is not its sole identity.
• The public demo becomes static and makes no app-api request.
• Every Enterprise Runtime receives its own show-once Portal key, registers once, authenticates heartbeat/manual sync and verifies signed atomic policy/config generations.
• The native Cloud Run service is a controlled implementation detail and all operational routes authenticate independently.

Compatibility and operator action

• Minimum compatible Runtime: v0.9.8. Runtime v0.9.7 can register and sync a signed generation, but cannot project that managed policy into the first governed operation's audit evidence; upgrade Enterprise agents before use.
• /api/public, embedded Swagger/portal execution and direct Runtime audit ingest are removed from the target Control Plane.
• Existing Community/local Runtime behavior remains available when Portal is disabled.
• Existing controlled-demo state is disposable. An enrolled Runtime may recover after an app-api SQLite reset only when a newly issued key returns the same pinned organization and policy/config signing key; otherwise use a fresh disposable Runtime Home.
• Customer image publication is not yet selected. Until registry, signing, SBOM/provenance, vulnerability and pull verification are approved and completed, release evidence must label the OCI digest candidate, not distributed.

Known limitations

• The controlled demo uses ephemeral SQLite and process-local rate limiting at max one instance. It is not a durable, multi-instance customer/SaaS storage claim; every hosted registration test uses a disposable Runtime Home.
• The browser JWT remains in sessionStorage; the later OIDC/SSO and RBAC work owns the production identity/session model.
• The app-ui OCI candidate is not customer-available until a separate registry, signing, SBOM/provenance, vulnerability and clean-pull gate is approved.
• The active hosted demo requires public Cloud Run invocation for browser requests. Cloudflare Access protects the UI, not the native backend; app-api authentication, exact CORS, rate limits, min-zero/max-one scaling, alerts and the documented demo-off IAM procedure remain independent safeguards.