Proto commits in unkeyed/unkey

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-08-22

feat(ctrl): reconcile ClickHouse user grants Amp-Thread-ID: https://ampcode.com/threads/T-01a0270b-1187-758e-839e-664130c79425

2026-08-20

feat(ctrl): add deployment garbage collection protocol Amp-Thread-ID: https://ampcode.com/threads/T-01a01a39-49f1-70cd-9ffe-0a4c383b146e

feat: manage Git and Docker app sources Amp-Thread-ID: https://ampcode.com/threads/T-019ff0e6-00a6-7028-afbb-9c2ac8ed94aa

fix: return persisted Docker image source Return the normalized image reference from ctrl so updateApp matches subsequent getApp and listApps responses. Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

fix: address Docker app review feedback Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

feat: separate git/docker in an app

feat(api): submit deployment rollbacks to Restate (#7046) Amp-Thread-ID: https://ampcode.com/threads/T-01a00ea7-7b5c-73fe-baef-483eef7756b2

feat(api): submit deployment promotions to Restate (#7045) Amp-Thread-ID: https://ampcode.com/threads/T-01a00ea7-7b5c-73fe-baef-483eef7756b2

feat(api): submit deployment starts to Restate (#7044) Amp-Thread-ID: https://ampcode.com/threads/T-01a00ea7-7b5c-73fe-baef-483eef7756b2

feat(api): submit deployment stops to Restate (#7043) Amp-Thread-ID: https://ampcode.com/threads/T-01a00ea7-7b5c-73fe-baef-483eef7756b2

2026-08-19

fix: address Docker app review feedback Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

fix: return persisted Docker image source Return the normalized image reference from ctrl so updateApp matches subsequent getApp and listApps responses. Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

feat: separate git/docker in an app

feat(api): submit deployment starts to Restate Amp-Thread-ID: https://ampcode.com/threads/T-01a00ea7-7b5c-73fe-baef-483eef7756b2

2026-08-18

chore(ctrl): remove unused deploy key auth field (#7048) Amp-Thread-ID: https://ampcode.com/threads/T-01a00e68-146d-739f-b594-59999705fcc0

refactor(dashboard, ctrl): move stopDeployment to the SDK (#6943) * refactor(dashboard, ctrl): move stopDeployment to the SDK and audit it in ctrl The dashboard reached ctrl through a trpc router that wrote the deployment.stop audit entry itself, so a root key calling the public API produced no entry at all. Move the write into ctrl, which every surface routes through, and point the dialog at the SDK instead. Also lands the plumbing the remaining lifecycle verbs reuse: ActorInfo on their ctrl requests, the audit event constants, and recordLifecycleAudit. * refactor: move permissions to deployments from environments

2026-08-17

feat(api,ctrl): add verifyDomain endpoint (#6941) * feat: add spec * feat: add handler * feat: add permissions * tests: add test for verify handler * refactor: add actor and tx to retryverification * fix: retry bug Retry was failling immeditealy when creation was a day old, but it should actually take the invocations start date instead of row createDate * chore: STE fix better specs * chore: tidy up spec * chore: tidy * chore: drop useless comments * chore: diff * chore: drop redudant comment * chore: address comments

feat(api, ctrl): add delete domain endpoint (#6931) * feat(api, ctrl): add delete domain endpoint * refactor: use uid * fix: specs * chore: tidy * chore: tidy punctuation issues * chore: update specs

feat(gateway): always-on base request log with five opt-in capture settings (#6921) * feat(gateway): move sentinel request logging behind a logging policy Request logging through the gateway was always on. It is now controlled by a new config-less `logging` sentinel policy: without an enabled, matching logging policy the gateway captures no request/response bodies and writes no ClickHouse row. - proto: new frontline.v1.Logging message, Policy oneof field 11 - frontline: engine sets Result.LogRequest; handler, forwarder, and ClickHouse middleware gate body capture and row emission on it - api: LoggingPolicy in OpenAPI spec, policyconfig conversion, and updatePolicy patch handling - dashboard: logging policy type in canonical schema, tRPC sentinel.logging router, add/edit panel form, and list row label - docs: note that logging is opt-in Closes #5424 (ENG-2612) Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(frontline): add proxy logging-overhead benchmarks; simplify logging policy UI copy Benchmarks drive real HTTP through the production middleware chain into a real upstream and assert whether ClickHouse rows were buffered, so each variant provably measures the intended logging path. UI copy for the logging policy form rewritten in Simplified Technical English. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * docs(gateway): state that a logging policy without match conditions logs all requests An empty match list matches every request. Pin the catch-all semantics with an integration test and state it in the proto comment, OpenAPI description, dashboard schema comment, and policy form copy. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * test(gateway): use typed policy fixtures and generated ids Replace raw protojson string literals and hardcoded pol_* ids in update-policy tests with typed frontlinev1.Policy fixtures marshaled through policyconfig and ids from uid.New. Also fix a broken link in the ratelimit analytics docs. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * chore: drop proxy benchmark, restore ratelimit analytics docs link Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(frontline): always write base request log, make headers/bodies capture opt-in The base log row (method, host, path, status, latency, user agent, IP) is now written for every proxied request so traffic and latency charts always work. The logging policy gains two capture flags, headers and bodies; headers also covers query string and parameters since URLs carry secrets. Without an enabled matching logging policy only the base row is stored. Redaction is unchanged. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(gateway): split logging capture into four independent opt-ins Request headers, response headers, request body, and response body are now separate capture flags on the logging policy. User agent and client IP move from the always-on base row to the request-headers opt-in since they identify the client. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * docs(gateway): use plain active-voice wording, say gateway instead of frontline Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * fix(dashboard): align logging policy switches right, tune wording Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(migrate): backfill full-capture logging policy for existing apps Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * fix(dashboard): center logging policy switches on their text block Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(gateway): split query capture into its own logging policy setting Review feedback: query data is not a header. Adds a fifth opt-in capture flag (query) for the query string and parameters; request headers keep user agent and client IP. Also softens docs/OpenAPI wording and links plan-based log retention. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * docs: align observability pages with plan-based retention and opt-in capture Request-log retention is plan-dependent; link quotas. Headers, bodies, and query data appear only when a logging policy captures them. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

fix(ctrl): reap stale deployment instances Amp-Thread-ID: https://ampcode.com/threads/T-019ffb60-1256-71bc-a8f6-bea8a32dd059

feat(gateway): always-on base request log with five opt-in capture settings (#6921) * feat(gateway): move sentinel request logging behind a logging policy Request logging through the gateway was always on. It is now controlled by a new config-less `logging` sentinel policy: without an enabled, matching logging policy the gateway captures no request/response bodies and writes no ClickHouse row. - proto: new frontline.v1.Logging message, Policy oneof field 11 - frontline: engine sets Result.LogRequest; handler, forwarder, and ClickHouse middleware gate body capture and row emission on it - api: LoggingPolicy in OpenAPI spec, policyconfig conversion, and updatePolicy patch handling - dashboard: logging policy type in canonical schema, tRPC sentinel.logging router, add/edit panel form, and list row label - docs: note that logging is opt-in Closes #5424 (ENG-2612) Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(frontline): add proxy logging-overhead benchmarks; simplify logging policy UI copy Benchmarks drive real HTTP through the production middleware chain into a real upstream and assert whether ClickHouse rows were buffered, so each variant provably measures the intended logging path. UI copy for the logging policy form rewritten in Simplified Technical English. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * docs(gateway): state that a logging policy without match conditions logs all requests An empty match list matches every request. Pin the catch-all semantics with an integration test and state it in the proto comment, OpenAPI description, dashboard schema comment, and policy form copy. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * test(gateway): use typed policy fixtures and generated ids Replace raw protojson string literals and hardcoded pol_* ids in update-policy tests with typed frontlinev1.Policy fixtures marshaled through policyconfig and ids from uid.New. Also fix a broken link in the ratelimit analytics docs. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * chore: drop proxy benchmark, restore ratelimit analytics docs link Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(frontline): always write base request log, make headers/bodies capture opt-in The base log row (method, host, path, status, latency, user agent, IP) is now written for every proxied request so traffic and latency charts always work. The logging policy gains two capture flags, headers and bodies; headers also covers query string and parameters since URLs carry secrets. Without an enabled matching logging policy only the base row is stored. Redaction is unchanged. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(gateway): split logging capture into four independent opt-ins Request headers, response headers, request body, and response body are now separate capture flags on the logging policy. User agent and client IP move from the always-on base row to the request-headers opt-in since they identify the client. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * docs(gateway): use plain active-voice wording, say gateway instead of frontline Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * fix(dashboard): align logging policy switches right, tune wording Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(migrate): backfill full-capture logging policy for existing apps Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * fix(dashboard): center logging policy switches on their text block Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * feat(gateway): split query capture into its own logging policy setting Review feedback: query data is not a header. Adds a fifth opt-in capture flag (query) for the query string and parameters; request headers keep user agent and client IP. Also softens docs/OpenAPI wording and links plan-based log retention. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498 * docs: align observability pages with plan-based retention and opt-in capture Request-log retention is plan-dependent; link quotas. Headers, bodies, and query data appear only when a logging policy captures them. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

feat(api,ctrl): add verifyDomain endpoint (#6941) * feat: add spec * feat: add handler * feat: add permissions * tests: add test for verify handler * refactor: add actor and tx to retryverification * fix: retry bug Retry was failling immeditealy when creation was a day old, but it should actually take the invocations start date instead of row createDate * chore: STE fix better specs * chore: tidy up spec * chore: tidy * chore: drop useless comments * chore: diff * chore: drop redudant comment * chore: address comments

feat(api, ctrl): add delete domain endpoint (#6931) * feat(api, ctrl): add delete domain endpoint * refactor: use uid * fix: specs * chore: tidy * chore: tidy punctuation issues * chore: update specs

fix: address Docker app review feedback Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

fix: return persisted Docker image source Return the normalized image reference from ctrl so updateApp matches subsequent getApp and listApps responses. Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

feat: separate git/docker in an app

2026-08-15

Merge remote-tracking branch 'origin/main' into flo/docker-image-apps Amp-Thread-ID: https://ampcode.com/threads/T-019ff0e6-00a6-7028-afbb-9c2ac8ed94aa # Conflicts: # svc/api/routes/v2_portal_create_session/200_app_test.go # web/apps/dashboard/app/(app)/[workspaceSlug]/projects/[projectId]/(project)/requests/components/table/request-log-details/index.tsx

2026-08-13

fix(ctrl): reap stale deployment instances Amp-Thread-ID: https://ampcode.com/threads/T-019ffb60-1256-71bc-a8f6-bea8a32dd059

feat(frontline): allow per-policy credit cost overrides for keyauth (#7009) * fix: allow credits to be 0 * fix: make the UI better * Expose key credits on gateway principals * Reject negative keyauth credit costs

feat: add gitlab provider slop

2026-08-12

fix: allow credits to be 0

feat(sentinel): compound identifiers for ratelimit policies (#6942) * feat(sentinel): support compound identifiers in ratelimit policies A ratelimit policy previously grouped requests by a single identifier source. Compound keys such as [authenticatedSubject, path] were not possible without one policy per route or per-key ratelimit updates. - proto: add repeated identifiers alongside legacy identifier - api: accept exactly one of identifier or identifiers (max 5) - frontline: compose escaped multi-dimension bucket keys; legacy single identifiers keep their raw keys - dashboard: repeatable identifier rows in the sentinel policy form Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee * docs(gateway): document compound ratelimit identifiers Also point the dashboard docs link at the current page anchor; the old sentinel path and rate-limit-subjects anchor no longer exist. Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee * perf(frontline): single-pass compound ratelimit key composition Replace the two-pass ReplaceAll escaping and slice+Join composition with one pre-sized builder and one scan per part. Compound keys now cost one allocation; the legacy single-identifier path allocates nothing. BenchmarkExtractIdentifier (Xeon 2.60GHz): legacy single 4.3 ns/op 0 allocs compound clean 86.0 ns/op 1 alloc compound escaped 98.8 ns/op 1 alloc Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee * refactor: write ratelimit policies with identifiers array only Legacy single identifier stays readable everywhere, but every write path now emits the repeated identifiers form: - API normalizes deprecated identifier input to a one-entry identifiers proto list and never populates the deprecated proto field. - API responses always render identifiers, also for stored legacy blobs. - Dashboard serializes identifiers for one row too. - Proto and OpenAPI mark the single identifier deprecated. This lets us remove the legacy field later without a data migration. Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee * test(api): expect identifiers array in list_policies responses Missed in the write-path migration: responses now always render the identifiers array, also for legacy stored blobs. The test dereferenced the legacy field and panicked. Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee

fix(ctrl): harden BuildSlotService against stuck and leaked build slots (#6966) * fix(ctrl): harden BuildSlotService against stuck and leaked build slots Bound the build-slot wait with a 6h timeout, bound the limits fetch inside the workspace VO (a missing limits row previously retried forever while holding the key lock), add a self-expiring lease (new ExpireSlot handler) that reclaims slots from dead or stuck deployments, and set an explicit kill-on-exhaustion invocation retry policy on the service binding. Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * fix(ctrl): verify build slot occupancy against Restate invocation liveness VO state outlives invocations: a killed or purged Deploy invocation never runs its Release compensation, so its deployment ID stays in active_slots forever. Scheduled leases alone cannot cover entries that predate their own deployment or kills that land between journal entries. Add a pull-based audit: when a workspace is at capacity, AcquireOrWait now verifies every active slot against the deployments table AND Restate's sys_invocation introspection (dropped rows = dead invocation), reclaims stale slots on the spot, and promotes waiters. ExpireSlot uses the same liveness check so a dead-but-DB-active deployment is force-failed immediately instead of after the full lease. Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * docs(ctrl): simplify build slot comments Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * fix(ctrl): cut build slot max wait from 6h to 1h Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * feat(ctrl): renew build slot lease while deploy invocation is live Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * fix(restate): make liveness query robust and dedupe admin client HTTP handling Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * refactor(ctrl): journal effective build limit as plain number Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * test(ctrl): reproduce stale build slot recovery against real Restate Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * refactor(restate): fold admin HTTP handling into one send helper and generic call Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a * fix(ctrl): force-fail reclaimed deployments and prune dead waiters before promotion Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a

2026-08-11

fix: address Docker app review feedback Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

fix: return persisted Docker image source Return the normalized image reference from ctrl so updateApp matches subsequent getApp and listApps responses. Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

feat: separate git/docker in an app

2026-08-08

feat(ctrl): renew build slot lease while deploy invocation is live Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a

docs(ctrl): simplify build slot comments Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a

feat(ctrl): migrate build concurrency to Restate vqueues Amp-Thread-ID: https://ampcode.com/threads/T-019fe134-cebd-729b-b74f-3d8246d7247d

fix(ctrl): harden BuildSlotService against stuck and leaked build slots Bound the build-slot wait with a 6h timeout, bound the limits fetch inside the workspace VO (a missing limits row previously retried forever while holding the key lock), add a self-expiring lease (new ExpireSlot handler) that reclaims slots from dead or stuck deployments, and set an explicit kill-on-exhaustion invocation retry policy on the service binding. Amp-Thread-ID: https://ampcode.com/threads/T-019fdcd2-17aa-7578-b633-6eb653aa7f9a

2026-08-07

fix: return persisted Docker image source Return the normalized image reference from ctrl so updateApp matches subsequent getApp and listApps responses. Amp-Thread-ID: https://ampcode.com/threads/T-019fd25a-fe32-7754-a268-ae5239b34471

feat(gateway): split query capture into its own logging policy setting Review feedback: query data is not a header. Adds a fifth opt-in capture flag (query) for the query string and parameters; request headers keep user agent and client IP. Also softens docs/OpenAPI wording and links plan-based log retention. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

refactor: add actor and tx to retryverification

refactor(dashboard, ctrl): move stopDeployment to the SDK and audit it in ctrl The dashboard reached ctrl through a trpc router that wrote the deployment.stop audit entry itself, so a root key calling the public API produced no entry at all. Move the write into ctrl, which every surface routes through, and point the dialog at the SDK instead. Also lands the plumbing the remaining lifecycle verbs reuse: ActorInfo on their ctrl requests, the audit event constants, and recordLifecycleAudit.

feat(api, ctrl): add delete domain endpoint

2026-08-06

feat: separate git/docker in an app

feat(api): add createDomain endpoint (#6915) * feat(api): add createDomain endpoint * refactor: response body * refactor: drop redundant field * chore: update specs * feat: add sdk * chore: drop redundant comments * chore: tidy up spec * refactor: add limits, tighten regex and tests This commit also adds shared domaingate to enforce same checks for both RPC and API * chore: fix smell and minor test issues * fix: error name * refactor: group connectURL * fix: wording * fix: spec * chore: tidy * refactor: add retry for verifyDomain workflow call * refactor: move helper queries to sqlc instead of inlining * fix: wording * refactor: use limitsCache * chore: add missing cache remove * fix: wording * chore: tidy * chore: tidy * chore: add missing gen files * chore: use "attached" instead of "registered" everywhere * refactor(spec): share DomainId schema for createDomain * feat(spec): report per-record verification on dns records * chore: move from attached to exists * refactor: move domain gate to its own pkg * fix: typos and descriptions * chore: remove redaction * refactor: use uidDNS and remove redundant query * refactor: update proto * refactor: remove retry * refactor: instead of regex use our own validator for domains * refactor: handle custom domain insertions gracefully We used to add custom domain row then fire workflow, but when db commit didnt land properly before the workflow call it was failing right away. So now we give workflow some grace period and rollback everything if invocation fails before that actual workflow starts. so API can stay idempotent * refactor: proto so it doesnt break dashboard * chore: fix spec punctuation * chore: tidy up

docs(gateway): use plain active-voice wording, say gateway instead of frontline Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

refactor: write ratelimit policies with identifiers array only Legacy single identifier stays readable everywhere, but every write path now emits the repeated identifiers form: - API normalizes deprecated identifier input to a one-entry identifiers proto list and never populates the deprecated proto field. - API responses always render identifiers, also for stored legacy blobs. - Dashboard serializes identifiers for one row too. - Proto and OpenAPI mark the single identifier deprecated. This lets us remove the legacy field later without a data migration. Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee

feat(sentinel): support compound identifiers in ratelimit policies A ratelimit policy previously grouped requests by a single identifier source. Compound keys such as [authenticatedSubject, path] were not possible without one policy per route or per-key ratelimit updates. - proto: add repeated identifiers alongside legacy identifier - api: accept exactly one of identifier or identifiers (max 5) - frontline: compose escaped multi-dimension bucket keys; legacy single identifiers keep their raw keys - dashboard: repeatable identifier rows in the sentinel policy form Amp-Thread-ID: https://ampcode.com/threads/T-019fd2b3-a828-76fa-a589-4b3c461ab5ee

Merge branch 'main' into eng-2612-logging-policy Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

feat(gateway): split logging capture into four independent opt-ins Request headers, response headers, request body, and response body are now separate capture flags on the logging policy. User agent and client IP move from the always-on base row to the request-headers opt-in since they identify the client. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

feat(frontline): always write base request log, make headers/bodies capture opt-in The base log row (method, host, path, status, latency, user agent, IP) is now written for every proxied request so traffic and latency charts always work. The logging policy gains two capture flags, headers and bodies; headers also covers query string and parameters since URLs carry secrets. Without an enabled matching logging policy only the base row is stored. Redaction is unchanged. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

refactor: add actor and tx to retryverification

feat(api, ctrl): add delete domain endpoint

refactor: proto so it doesnt break dashboard

refactor: update proto

feat(api): add createDomain endpoint

Remove workspace quotas table (#6913) * Remove workspace quotas table * style: fmt * test: set autoscaling limit for environment settings success

2026-08-05

docs(gateway): state that a logging policy without match conditions logs all requests An empty match list matches every request. Pin the catch-all semantics with an integration test and state it in the proto comment, OpenAPI description, dashboard schema comment, and policy form copy. Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

feat(gateway): move sentinel request logging behind a logging policy Request logging through the gateway was always on. It is now controlled by a new config-less `logging` sentinel policy: without an enabled, matching logging policy the gateway captures no request/response bodies and writes no ClickHouse row. - proto: new frontline.v1.Logging message, Policy oneof field 11 - frontline: engine sets Result.LogRequest; handler, forwarder, and ClickHouse middleware gate body capture and row emission on it - api: LoggingPolicy in OpenAPI spec, policyconfig conversion, and updatePolicy patch handling - dashboard: logging policy type in canonical schema, tRPC sentinel.logging router, add/edit panel form, and list row label - docs: note that logging is opt-in Closes #5424 (ENG-2612) Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

feat: separate git/docker in an app

2026-08-04

feat(gateway): move sentinel request logging behind a logging policy Request logging through the gateway was always on. It is now controlled by a new config-less `logging` sentinel policy: without an enabled, matching logging policy the gateway captures no request/response bodies and writes no ClickHouse row. - proto: new frontline.v1.Logging message, Policy oneof field 11 - frontline: engine sets Result.LogRequest; handler, forwarder, and ClickHouse middleware gate body capture and row emission on it - api: LoggingPolicy in OpenAPI spec, policyconfig conversion, and updatePolicy patch handling - dashboard: logging policy type in canonical schema, tRPC sentinel.logging router, add/edit panel form, and list row label - docs: note that logging is opt-in Closes #5424 (ENG-2612) Amp-Thread-ID: https://ampcode.com/threads/T-019fcd3b-b313-7359-a7a0-53150fc0e498

feat(api): add createDomain endpoint

Remove workspace quotas table

feat(api): add createDomain endpoint

2026-08-03

Remove workspace quotas table

Add durable legacy billing invoice workflow (#6909) - Create resumable, fail-closed Stripe draft invoices from legacy pricing - Validate workspace state, usage tiers, and invoice reconciliation - Document manual invocation, review, and recovery procedures

Merge branch 'main' into chronark/billing

Add durable legacy billing invoice workflow - Create resumable, fail-closed Stripe draft invoices from legacy pricing - Validate workspace state, usage tiers, and invoice reconciliation - Document manual invocation, review, and recovery procedures

Add second frontline cert (#6894) * Identify Krane clusters by immutable cell ID - Replace region-scoped RPC keys with cell, platform, and region identities - Persist and validate one-time cell claims to prevent cluster collisions - Document and configure the new Krane cluster identity fields * Remove redundant cluster lookup from heartbeat registration * Refresh cluster cell identity on every heartbeat * Provision wildcard certificates for frontline cells --------- Co-authored-by: Amp <amp@ampcode.com>

2026-07-31

feat: separate git/docker in an app

2026-07-30

feat: separate git/docker in an app

Identify Krane clusters by immutable cell ID - Replace region-scoped RPC keys with cell, platform, and region identities - Persist and validate one-time cell claims to prevent cluster collisions - Document and configure the new Krane cluster identity fields

2026-07-29

feat: separate git/docker in an app

2026-07-24

feat(ctrl): Compute billing reconcile engine (D9) Reconcile one (workspace, period) — the finalized Stripe invoice against live ClickHouse usage — and return a verdict (clean / late_data_underbill / overbill / structural). No DB, no snapshot: the invoice is the durable billed record and T+72h is inside the 95-day checkpoint TTL. Design and decisions in svc/ctrl/internal/billingreconcile/DECISIONS.md.

2026-07-23

feat(ctrl): Compute billing reconcile engine (D9) Reconcile one (workspace, period) — the finalized Stripe invoice against live ClickHouse usage — and return a verdict (clean / late_data_underbill / overbill / structural). No DB, no snapshot: the invoice is the durable billed record and T+72h is inside the 95-day checkpoint TTL. Design and decisions in svc/ctrl/internal/billingreconcile/DECISIONS.md.

feat: sepeerate git/docker from app

2026-07-22

Merge branch 'main' of github.com:unkeyed/unkey into chronark/prune-registry # Conflicts: # gen/proto/hydra/v1/cron.pb.go # gen/proto/hydra/v1/cron_restate.pb.go # go.mod # svc/ctrl/integration/harness/BUILD.bazel # svc/ctrl/integration/harness/harness.go # svc/ctrl/internal/db/deployment_status.go # svc/ctrl/proto/hydra/v1/cron.proto # svc/ctrl/worker/BUILD.bazel # svc/ctrl/worker/config.go # svc/ctrl/worker/cron/BUILD.bazel # svc/ctrl/worker/cron/cron.go # svc/ctrl/worker/project/BUILD.bazel # svc/ctrl/worker/run.go

refactor(ctrl): unify deployment resource pruning

feat(ctrl): prune orphaned deployment resources

2026-07-17

feat(ctrl): Deploy spend-cap enforcement suspend/resume (ENG-2923) (#6542)

2026-07-16

feat(ctrl): Deploy spend-cap enforcement suspend/resume (ENG-2923)

feat(ctrl): rewire Deploy cancel through ctrl-api (ENG-2922) (#6541)

feat(ctrl): Deploy teardown service (ENG-2922) (#6540)

feat(ctrl): Deploy spend-cap enforcement suspend/resume (ENG-2923)

feat(ctrl): Deploy teardown service (ENG-2922)

feat(ctrl): rewire Deploy cancel through ctrl-api (ENG-2922)

feat(billing): Deploy spend-cap detection and budget alerts (ENG-2904) (#6486)

feat: add schema (#6698)

2026-07-15

feat(ctrl): Deploy spend-cap enforcement suspend/resume (ENG-2923)

feat(ctrl): rewire Deploy cancel through ctrl-api (ENG-2922)

feat(billing): Deploy spend-cap detection and budget alerts (ENG-2904)

feat(ctrl): Deploy teardown service (ENG-2922)

2026-07-14

refactor(ctrl)!: per-workspace push invocations for deploy billing (#6452)

refactor: validate through protojson marshal if it fails we know payload is broken

feat(ctrl): Deploy spend-cap enforcement suspend/resume (ENG-2923)

feat(ctrl): rewire Deploy cancel through ctrl-api (ENG-2922)

feat(ctrl): Deploy teardown service (ENG-2922)

2026-07-13

feat(billing): Deploy spend-cap detection and budget alerts (ENG-2904)