Change Log

This change log starts with the open source publication of the Platform Orchestrator ecosystem.

October 27, 2026

Application and client security updates

The compatible application patch set is Control Plane 3.1.1 , Data Plane 4.0.1 , IAM 2.5.1 , and Console 1.4.2 . The matching client patches are octl 2.1.1  and Terraform/OpenTofu provider 2.1.1 . They preserve the 2.1.0 contracts; upgrade to receive their dependency fixes. The provider is indexed by both the Terraform and OpenTofu registries.

  • Security: The three server patches, CLI, and provider use Go 1.26.10 and updated affected dependencies. Console 1.4.2 updates its browser and serving dependencies. The incomplete Console 1.4.1 publication is superseded by 1.4.2; do not select 1.4.1 as a released image.
  • Compatibility: These patches preserve the application API wire contracts and existing database schemas. CLI commands and provider resource/state contracts retain their 2.1.0 behavior. No application database migration is part of this patch set. Back up application data, configuration, credentials, and Terraform/OpenTofu state before upgrading; drain active Deployments.
  • Self-hosted chart: Chart 0.8.1  pins this four-image set, pairs the Keycloak server and Operator at 26.8.1, and adds optional Gateway external traffic policy settings. Read its release notes and self-hosting guidance before upgrading, particularly the Keycloak migration and recovery steps.
  • Separate artifacts: Runner remains at 3.1.0, and the plugin runtime is unchanged. External OpenBao is maintained separately and is not upgraded by this release.

October 22, 2026

Plugin foundation (v1alpha)

The released compatible set is Control Plane 3.1.0 , Data Plane 4.0.0 , IAM 2.5.0 , Console 1.4.0 , octl 2.1.0 , and Terraform/OpenTofu provider 2.1.0 . Use Platform Orchestrator chart 0.8.0  with this set. The separate native plugin runtime and chart are 0.1.0 ; Runner stays at 3.1.0.

  • Provider availability: Version 2.1.0 is published on GitHub and the OpenTofu Registry. As of October 22, the Terraform Registry has not indexed it yet, so a normal Terraform installation of that version is not available. See Terraform/OpenTofu provider.

  • New: Core can host separately packaged, first-party Stellwerk plugins at contract level v1alpha. The Plugin Manager records installation and per-organization enablement in Core’s database. The runtime chart starts a plugin workload, but deploying that workload does not install or enable the plugin in Core. A signed package and a valid entitlement are separate from installation, enablement, and user permissions. Core continues to work with no plugin installed. See Plugin host architecture and installation and operation.

  • Boundaries: One plugin installation uses one runtime, one platform principal, and one plugin-owned database across its enabled organizations. Core checks each effect within its organization, but a compromised plugin can reach every enabled organization within its grants, and a plugin bug can mix data in that shared database. Plugin UI pages run in a sandboxed iframe on a separate origin. Offline package verification uses operator-supplied publisher trust; entitlements use separately trusted issuer keys. Native plugin workloads require Kubernetes 1.30 or newer. This first release does not offer a stable partner contract or a general-purpose code sandbox.

  • Breaking API behavior: Data Plane 4.0.0 defaults a raw deploy or rollback request that omits when_busy to queue. A busy Environment returns a queue item instead of the previous HTTP 409. Send when_busy: reject to retain the fail-fast response; octl offers --no-queue. Requests authorized by a deprecated organization token still return HTTP 409 environment_busy and never queue; use a user or service user token to wait. Review queued work before upgrading scripts. See Core-only installations.

  • Upgrade and recovery: Back up databases, keys, Helm values, and client state, then drain Deployments before upgrading the compatible set. After the new writers or migrations run, do not roll back to chart 0.7.0 or its older Core images. Recover by rolling forward or switching the plugin host off with schema-compatible Core images. See Plugin recovery.

September 25, 2026

  • New: Released Module Version Management with stable Module catalogue identities, complete immutable SemVer versions, explicit Proposed-to-Default promotion, retained history and comparison, adoption visibility, and exact Environment Pins.
  • Released: The compatible server and UI set is control plane v3.0.0 , IAM v2.4.0 , data plane v3.2.0 , Runner v3.1.0 , and Console v1.3.0 .
  • Clients: Use CLI v2.0.0  and Terraform/OpenTofu provider v2.0.0  with this server set. New managed writes replace mutable Module definitions with complete version publication and make Resource Type interfaces immutable.
  • Contracts: Optional Module contracts can check the six authoring interface fields offline. When a Resource Type has a nonempty output schema, each new version must declare that schema explicitly. External sources require an immutable revision; an artifact digest is optional and, when supplied, remains a claim rather than trusted verification. See Module version management and Resource Type conformance.
  • Upgrade: Plan a maintenance migration, back up data and state, drain active Deployments, stop older writers, and upgrade the compatible component and client set together. Historical opaque versions remain retained as generation v0, but older writers and destructive database downgrades are not supported after managed writes begin. Follow the migration and recovery guide.
  • Self-hosted: Released the qualified Platform Orchestrator chart v0.7.0  with the exact compatible component images. The component set passed fresh-install, upgrade, normal Runner deployment, encrypted-output, rollback-recovery, CLI, Terraform, and OpenTofu exercises. The downloaded public chart was then checked against the tested package and used for another upgrade and real deployment. The First Deployment configuration at 43346a2  uses this release set.

August 29, 2026

  • New: Released platform-orchestrator-cli v1.2.0  with role and permission discovery, SCIM group-mapping administration, service-user creation and credential rotation, and metadata-key lifecycle commands.
  • New: Released terraform-provider-platform-orchestrator v1.1.0  with resources for configurable roles, SCIM group mappings, and metadata keys, plus data sources for roles, permissions, mappings, and metadata-key inventories.
  • API: Released IAM v2.3.1  with stable service-user cursor pagination and corrected member pagination, preventing skipped rows during automation inventory reads.
  • API: Released data plane v3.1.1  with explicit omission, null, and value semantics for metadata-key updates. Terraform can now clear optional constraints without replacing the key.
  • Self-hosted: Released Platform Orchestrator Helm chart v0.6.1  with IAM v2.3.1 and data plane v3.1.1.
  • Secure: Updated vulnerable runtime dependencies in the data plane and Terraform provider. Reachability analysis found no remaining called vulnerable symbols in IAM, data plane, CLI, or provider.
  • Docs: Added complete CLI examples and Terraform/OpenTofu configuration for the new automation surface. Service users remain intentionally excluded from Terraform so one-time bearer credentials are not persisted in state.
  • Qualified: All four repositories passed generation, build, unit, integration or acceptance, lint, and hosted CI gates. The final fork images also passed complete CLI/API/SCIM and Terraform lifecycle exercises on WX1, including cleanup and direct residue checks.

August 28, 2026

  • New: Released IAM v2.3.0  with organization-scoped SCIM 2.0 user and group provisioning, scoped service-user bearer credentials, group-to-role mappings, and provisioning audit events.
  • Secure: SCIM deprovisioning now revokes sessions and device logins, blocks SSO and invitation paths from restoring access, preserves access in other organizations, and keeps every directory operation tenant-scoped.
  • Compatible: Added SCIM discovery resources, pagination and filtering, case-insensitive PATCH operations, full-resource PUT updates, and the wire formats required by common Entra and Authentik provisioning flows.
  • Improved: Released self-hosted chart v0.6.0  with IAM v2.3.0 and public routes for the SCIM protocol and group-mapping management API.
  • Docs: Added the SCIM provisioning guide, including worked configurations for Microsoft Entra ID and Authentik.
  • Qualified: The final IAM release passed 430 unit tests, 348 clean-database integration tests, authorization-upgrade coverage, static analysis, and vulnerability scanning. The audited image and feature chart also completed a SCIM end-to-end exercise on WX1 before release.

August 25, 2026

  • New: Released IAM v2.2.0  with an authoritative catalog of 34 entity-specific read and write permissions. Role create and update requests now reject unknown permission identifiers.
  • New: Released control plane v2.1.0  and data plane v3.1.0  with granular authorization checks for each supported orchestrator entity.
  • New: Released console v1.2.0  with a role editor that loads, describes, and groups the permission catalog, so operators can build roles without guessing identifiers.
  • API: Added the permission-catalog endpoint, complete request and response examples, valid permission values, role payloads, and end-to-end role and service-user workflows to the RBAC guide and API specification.
  • Compatible: Existing built-in and configurable roles keep their previous effective access through explicit legacy permission implications. This also permits IAM to roll out before the control plane and data plane.
  • Improved: Released self-hosted chart v0.5.0  with the granular components and the public permission-catalog route.
  • Qualified: Verified a module-only role returned 403 for project and deployment writes on WX1, then completed the installer base, Redis, PostgreSQL, independent verification, and teardown scenarios.

August 21, 2026

  • New: Added configurable organization roles with explicit permissions, while keeping the built-in Admin, Deployer, and Viewer roles immutable. Released console v1.1.0  with role listing, creation, editing, and deletion under Settings → Roles.
  • API: Published the complete listRoles, createRole, getRole, updateRole, and deleteRole contract in the API specification.
  • Improved: Released platform-orchestrator-cli v1.1.0  with IAM client bindings generated from the same Casbin RBAC and configurable role API contract.
  • Changed: Released IAM v2.1.0  with Casbin authorization evaluated inside IAM and policy data stored in the existing IAM PostgreSQL database.
  • Improved: Added bounded in-process authorization caches and NATS invalidation so role and assignment changes propagate across IAM replicas without a shared remote authorization service on every request.
  • Simplified: Released self-hosted chart v0.4.0 , removing the SpiceDB workload, operator, endpoint, pre-shared key, and separate runtime database dependency.
  • Fixed: Released qualified chart v0.4.3  with console v1.1.0, an application-account-safe NATS bootstrap probe, and the runner gateway wired to the documented NATS endpoint. It supersedes the intermediate 0.4.1 and 0.4.2 chart revisions.
  • Upgrade: Chart 0.4.3 automatically migrates qualified IAM v2.0.1 installations from schema 29 to Casbin during an ordinary Helm upgrade. The migration is serialized, resumable, verified before readiness, and retains the former SpiceDB database for a guarded rollback window. Follow the upgrade procedure  before rollout.

August 11, 2026

  • Breaking: Standardized runner communication on outbound HTTPS through a stateless runner gateway. Runner agents and deployment Jobs no longer receive broker endpoints or credentials; JetStream remains the Orchestrator’s internal durable transport.
  • New: Added short-lived Ed25519 agent authentication, deployment-scoped Job tokens, encrypted portable delivery receipts, separate public and cluster-internal gateway endpoints, and multi-replica gateway operation without sticky sessions.
  • New: Added simple, edge, and air-gap deployment modes. Edge installations persist results and encrypted logs in an RWX HTTPS outbox during outages. Air-gap installations run a protected-side gateway and broker and require a separately authorized reverse relay to return results and logs.
  • Changed: Released runner and data plane v3.0.0, Kubernetes runner chart 0.3.0, Kubernetes and ECS runner modules v4.0.0, use cases v3.0.0, and self-hosted chart v0.3.0 for the gateway architecture.
  • Simplified: Documented that kubernetes, kubernetes-gke, and kubernetes-eks use the same Kubernetes Job executor. Their differences are cluster discovery and temporary cloud authentication, not separate runtime implementations.

July 23, 2026

  • Improved: Migrated GitHub Actions across the Stellwerk Labs and Stellwerk Terraform module repositories from Node 20-backed action releases to Node 24-compatible releases.
  • Improved: Moved the remaining Terraform module CI callers from the former Humanitec reusable workflows to stellwerk-tf-modules/reusable-workflows .
  • Improved: Enabled Dependabot updates for GitHub Actions in workflow-bearing repositories so future runtime migrations arrive as routine dependency updates.
  • Improved: Updated the developer documentation build to Node.js 22 LTS while keeping GitHub Actions themselves on their supported Node 24 runtime.

July 20, 2026

  • New: Published the shared golib  and platform-orchestrator-graph  source repositories and their v1.0.0 releases.
  • New: Published the Platform Orchestrator control plane , data plane , frontend , IAM service , and runner  source repositories.
  • New: Published the images  catalog and versioned, multi-platform container images for the control plane, data plane, frontend, IAM service, and runner under ghcr.io/stellwerk-labs.
  • New: Released the hardened runner as v1.0.3 ; remote mode now requires an explicitly configured endpoint.
  • Improved: Released the self-hosted Platform Orchestrator Helm chart as v0.1.8 , with current public Stellwerk images for all five services.
  • New: Published the Kubernetes agent runner chart 0.1.1 at oci://ghcr.io/stellwerk-labs/charts/platform-orchestrator-kubernetes-agent-runner.
  • New: Published the signed stellwerk-labs/platform-orchestrator  provider in the OpenTofu Registry.
  • Improved: Updated the documentation for a self-hosted-only offering and per-installation OIDC issuers; the guides no longer assume a hosted Stellwerk API or central OIDC service.

July 13, 2026

July 10, 2026

July 9, 2026

Roadmap