Changelog

What shipped, and when.

One entry per released version, newest first, in the words the release was published with. Each version has its own link: this page with #v and the version number.

0.2.13 · Standard release

0.2.13 - execution-log retention, transactional key caps, and the internal Keyout executor

Released 2026-08-23. This is the first version carried by the artifact registry and the changelog feed; earlier versions predate both.

What changed

API Gateway execution-log groups are declared with a 365 day retention across the HSM, internal-purge and internal-escrow APIs. They previously auto-created at first invoke with no expiry and outlived a teardown (#813).
Lambda error alarms collapsed to the money paths plus one account roll-up, behind a granularity dial (#821).
Both key caps are enforced in one transaction, and a tenant with no seeded counter fails closed instead of open (#790, #820).
The internal Keyout executor ships in the spoke (#802).
The cancel-fact pair moved into the canonical event contract (#323).
Console create is idempotent and no longer double-submits (#789).
The tenant Hub wiring is unpinned and carries a CONFIG#TENANT backfill (#791).
Pre-creation KMS grants are hardened rather than narrowed (#778, #784).
nanoid, dompurify and postcss are bumped to clear the web advisories (#806, #795).

Applying this version

A spoke that adopts pre-existing API Gateway execution-log groups supplies its log-group ids once through the per-root import map, then resets the map to empty. A fresh vend creates the groups and needs no operator step.