v0.8.2 changes and upgrade boundaries
What this release adds
Section titled “What this release adds”Admin-managed Provider egress proxies
Section titled “Admin-managed Provider egress proxies”Administrators can create reusable HTTP or HTTPS CONNECT proxies, store Basic Auth credentials encrypted in the Vault, test connectivity, and bind a proxy to a Provider. A Provider with a proxy never silently falls back to a direct connection.
Private, loopback, or clear-text authenticated endpoints require an explicit
risk acknowledgement. A container’s 127.0.0.1 is the container itself, not the
host; use a reviewed host gateway or network service instead.
Denser, responsive resource lists
Section titled “Denser, responsive resource lists”The Admin Console resource lists now keep their essential identity and status visible at narrow widths while moving secondary evidence into expandable detail. This is a presentation change, not a change to authorization or resource state.
Bedrock Region moves into the Credential
Section titled “Bedrock Region moves into the Credential”For Bedrock Mantle, Region is part of the credential-bound endpoint. Existing records are migrated during upgrade. After rollout, verify every Bedrock Credential, Provider, and Deployment before restoring traffic; do not create duplicate Regions on downstream objects.
Other important v0.7-to-v0.8 changes
Section titled “Other important v0.7-to-v0.8 changes”- Provider proxy lifecycle and connection testing are available in Admin.
- The current model enumeration and capability-evidence boundaries remain separate: discovery says which targets exist, not what they can do.
- Package channels have independent verification and may lag GitHub Release.
- Existing single-writer, backup, Master Key, and rollback requirements remain.
Upgrade and rollback
Section titled “Upgrade and rollback”- Read the changelog and back up the complete data set plus the separate Master Key or recovery material.
- Stop the writer. Never let two versions use the same data directory.
- Pin the new binary or image digest and start exactly one instance.
- Run health, Provider, Deployment, Route, pricing, and negative-policy checks.
- If acceptance fails, stop the new writer before restoring the matching backup, key material, configuration, and previous image.
See Install and deploy and Backup and restore for the complete operator procedure.
Current distribution channels
Section titled “Current distribution channels”| Channel | Status | Version boundary |
|---|---|---|
| GitHub Release | Available | v0.8.2; checksum, Sigstore, SBOM, and attestation verification required |
| GHCR | Available | v0.8.2 for linux/amd64 and linux/arm64; pin a digest in production |
| Homebrew | Available | May lag GitHub Release; check the installation page before upgrading |
| APT | In progress | Do not advertise or install until the signed snapshot and clean-host acceptance are complete |