docs(releases): add upcoming platform release notes #44

Manually merged

anton merged 2 commits from docs/releases into main

2026-10-21 04:23:59 +00:00

anton commented

2026-10-20 16:37:11 +00:00

Owner

Scope

Release notes only: Releases index, the Upcoming platform release entry, and navigation/llms.txt links. Guide and configuration-reference updates remain separate in #43. Both PRs target main independently. Upcoming is not a production rollout announcement.

Summary

Cover merged platform changes from d0f3ca9 through 1fad4127, with immutable range links and the existing release-page URL preserved. Keep Features and improvements, Fixes, and Rollout notes separate.
Explicitly describe ingress firewall fixes: configured application/STEVE/recovery source restrictions cannot be bypassed by broader AWS security groups; HTTP application routing checks the connection source, not forwarded headers.
Explicitly describe egress firewall fixes: enforce IPv4 destination/protocol/port allowlists including DNS, restrict guest-to-host services, block metadata/link-local access and IPv6 bypasses, and fail closed when installing policy.
Explain the required host/enclave redeployment, paired TAP-framing versions, and the public port-80 management exception. Retain all previous features, fixes and rollout cautions, including organization recovery, legacy-bootstrap retirement, dependency audit gates, dependency updates and deployment-validation fixes.
Dashboard Sentry reporting and the replacement new-account bootstrap are not advertised as shipped features. No existing guides or other PRs are modified.

Verification

Exact docs commit: 32795e826688816eaa581aa763863ac69283127a.
Platform scope: d0f3ca9ba594705324caccc69a57f31c115041fa → 1fad41270748eff75de9027b6469b5c4135b7acf.

PATH=/usr/bin:/bin make build-prod IMAGE_NAME=caution-docs-release-firewall
python3 /tmp/verify-release-firewall.py 32795e826688816eaa581aa763863ac69283127a
git diff --check 6589593a40398077551b601901df389171ba6340...HEAD
git merge-tree --write-tree HEAD 4223cfee034d68ee40013787ced666d849385373

Production build passed; 41 HTML pages and 3,510 local links/assets/anchors checked, no errors. Rendered checks cover the new firewall wording and rollout limitations, existing content, Upcoming status, range links, navigation and llms.txt.
All previous rollout paragraphs are preserved; tracked source hashes remained unchanged through validation. The original docs checkout and its staged work are untouched.
Synthetic merge with current #43 at 4223cfee is clean and preserves its complete navigation plus Releases. No new combined-site build is claimed.
Checked firewall claims against the merged implementation (8a3e193d), the renderer, firewall installer and proxy-service startup dependencies at the covered platform revision. This follow-up changes one file, +5/-1 lines; the complete PR still changes four files.
The first scratch-validator run used an obsolete navigation-path assertion from an earlier #43 revision. The assertion was corrected to compare the complete current navigation; the full validation rerun passed. No project content was changed to satisfy the stale assertion.

This supersedes the previous release-note verification. Documentation-only: no platform tests, live firewall acceptance, AWS operations, service restarts, deployments or merges performed. Scratch validation tools are not repository dependencies.

## Scope **Release notes only:** Releases index, the Upcoming platform release entry, and navigation/`llms.txt` links. Guide and configuration-reference updates remain separate in #43. Both PRs target `main` independently. Upcoming is not a production rollout announcement. ## Summary - Cover merged platform changes from `d0f3ca9` through `1fad4127`, with immutable range links and the existing release-page URL preserved. Keep Features and improvements, Fixes, and Rollout notes separate. - Explicitly describe **ingress firewall fixes**: configured application/STEVE/recovery source restrictions cannot be bypassed by broader AWS security groups; HTTP application routing checks the connection source, not forwarded headers. - Explicitly describe **egress firewall fixes**: enforce IPv4 destination/protocol/port allowlists including DNS, restrict guest-to-host services, block metadata/link-local access and IPv6 bypasses, and fail closed when installing policy. - Explain the required host/enclave redeployment, paired TAP-framing versions, and the public port-80 management exception. Retain all previous features, fixes and rollout cautions, including organization recovery, legacy-bootstrap retirement, dependency audit gates, dependency updates and deployment-validation fixes. - Dashboard Sentry reporting and the replacement new-account bootstrap are not advertised as shipped features. No existing guides or other PRs are modified. ## Verification Exact docs commit: `32795e826688816eaa581aa763863ac69283127a`. Platform scope: `d0f3ca9ba594705324caccc69a57f31c115041fa` → `1fad41270748eff75de9027b6469b5c4135b7acf`. ```sh PATH=/usr/bin:/bin make build-prod IMAGE_NAME=caution-docs-release-firewall python3 /tmp/verify-release-firewall.py 32795e826688816eaa581aa763863ac69283127a git diff --check 6589593a40398077551b601901df389171ba6340...HEAD git merge-tree --write-tree HEAD 4223cfee034d68ee40013787ced666d849385373 ``` - Production build passed; **41 HTML pages and 3,510 local links/assets/anchors** checked, no errors. Rendered checks cover the new firewall wording and rollout limitations, existing content, Upcoming status, range links, navigation and `llms.txt`. - All previous rollout paragraphs are preserved; tracked source hashes remained unchanged through validation. The original docs checkout and its staged work are untouched. - Synthetic merge with current #43 at `4223cfee` is clean and preserves its complete navigation plus Releases. No new combined-site build is claimed. - Checked firewall claims against the merged implementation (`8a3e193d`), the renderer, firewall installer and proxy-service startup dependencies at the covered platform revision. This follow-up changes **one file, +5/-1 lines**; the complete PR still changes four files. - The first scratch-validator run used an obsolete navigation-path assertion from an earlier #43 revision. The assertion was corrected to compare the complete current navigation; the full validation rerun passed. No project content was changed to satisfy the stale assertion. This supersedes the previous release-note verification. Documentation-only: no platform tests, live firewall acceptance, AWS operations, service restarts, deployments or merges performed. Scratch validation tools are not repository dependencies.

anton added 1 commit

2026-10-20 16:37:11 +00:00