Release notes

# Engineering Runtime Control Plane release notes

This is the canonical human-readable release history for the coordinated
Control Plane product: app-api, app-ui, demo-ui, api-docs and their deployed
configuration. Component repositories retain their own commits and build
identity; this file records the one customer-visible Control Plane release that
those exact revisions form together.

After `engineering-runtime-api-docs` is bootstrapped, its static
`/releases/` page publishes a verified read-only copy of these notes. The public
site is not the source of truth and must never describe an unreleased entry as
available.

Runtime binary releases remain independent. A Control Plane entry records its
minimum compatible Runtime version and links to the Runtime release notes; it
does not reuse or replace the Runtime version number.

## Unreleased — Control Plane v0.1.0 release candidate

**Theme:** static API reference, controlled Enterprise demo and portable
Enterprise app-ui distribution.

**Status:** Runtime `v0.9.8` is released, the execution-only app-api candidate
is deployed on Cloud Run, and `api.engineeringruntime.com` is now the
verified static Cloudflare Pages reference. Cloudflare Access now protects
`app.engineeringruntime.com`: an anonymous request receives the Access
challenge, and the product owner confirmed the authenticated browser flow
reaches the separate Enterprise portal login and works. app-ui is configured
against the native backend and Cloud Run public invocation is open at min zero /
max one for the active demo, while app-api still independently authenticates
every operational route. The coordinated Control Plane release remains
withheld only for final evidence/checklist reconciliation.

### Planned customer-visible changes

- `api.engineeringruntime.com` becomes a static, read-only API contract and
  Control Plane release-notes site with no live request execution.
- `app.engineeringruntime.com` becomes the Access-protected Enterprise UI and
  independently logs in to the execution-only app-api.
- The same app-ui source preserves that static Cloudflare Pages deployment and
  additionally produces a separately versioned unprivileged OCI candidate for
  customer OpenShift, GKE and Kubernetes deployments. app-ui and app-api remain
  separate images and scaling units. The first candidate records Control Plane
  `v0.1.0`, its source SHA and immutable digest; `latest` is not its sole
  identity.
- The public demo becomes static and makes no app-api request.
- Every Enterprise Runtime receives its own show-once Portal key, registers
  once, authenticates heartbeat/manual sync and verifies signed atomic
  policy/config generations.
- The native Cloud Run service becomes a controlled implementation detail and
  all operational routes authenticate independently.

### Compatibility and operator action

- Minimum compatible Runtime: `v0.9.8`. Runtime v0.9.7 can register and sync a
  signed generation, but cannot project that managed policy into the first
  governed operation's audit evidence; upgrade Enterprise agents before use.
- `/api/public`, embedded Swagger/portal execution and direct Runtime audit
  ingest are removed from the target Control Plane.
- Existing Community/local Runtime behavior remains available when Portal is
  disabled.
- Existing controlled-demo state is disposable. An enrolled Runtime may recover
  after an app-api SQLite reset only when a newly issued key returns the same
  pinned organization and policy/config signing key; otherwise use a fresh
  disposable Runtime Home.
- Customer image publication is not yet selected. Until registry, signing,
  SBOM/provenance, vulnerability and pull verification are approved and
  completed, release evidence must label the OCI digest `candidate, not
  distributed`.

### Release evidence

Release-candidate evidence is being recorded in the owning workspace proposal.
Runtime v0.9.8 has completed its separate public release, public CI, four-platform
Homebrew and private evidence gates. App-api tests, route/OpenAPI parity and the
live registration, signed sync, governed denial, replacement-key and
last-known-good paths pass against the closed Cloud Run candidate. The static
API reference is live from api-docs commit
`335938961995b0bcb6b1ebd540a85a174d84d6f3`, Cloudflare Pages deployment
`2736409d-3e8f-4f71-87ec-ddbcb33a5a10`: 23 paths, zero configured servers,
no request-execution controls or native Cloud Run URL, and the former Cloud Run
domain mapping is absent. App-ui commit
`7b8d3d3f898b2a3948aeff0acffaff103b0200e9` is live from Pages deployment
`20126b0f-d5d2-48b2-ad6f-809e88353c39` with the configured native backend:
public health returns 200, an operational request without a JWT returns 401,
the configured admin login and authenticated dashboard return 200, and CORS
allows only `https://app.engineeringruntime.com`. Cloudflare Access and an
authenticated browser smoke now pass: anonymous `app.` receives `302` to the
Access login and the product owner confirmed Access login followed by the
independent portal login. At release, this section will name the remaining
exact component identities, OCI candidate identity and known limitations. It
will never record passwords, tokens, API keys or secret values.