{
	"record": "CLEATUS GovCloud release notes",
	"offering": "CLEATUS GovCloud offering",
	"maintainedBy": "Engineering",
	"approvedBy": "Change Control Board",
	"process": "Every GovCloud production release has an entry here before it deploys. The production release workflow refuses to deploy a release tag that has no entry. Engineering writes the entry in a pull request that the Change Control Board approves before merge. Each entry states its deployment status, every pull request it carries, the changes to functionality and the changes that affect security, or states that the release has no security impact. Entries start with release v2026.10.17b-ksi-release; earlier releases are recorded in the significant change history and the change records of the release workflow.",
	"publication": {
		"humanReadable": "https://trust.cleat.ai/release-notes.md",
		"machineReadable": "https://trust.cleat.ai/release-notes.json"
	},
	"releases": [
		{
			"release": "v2026.10.23-20x-mla-optional-fix",
			"date": "2026-10-23",
			"status": "pending deployment",
			"functionality": [
				"No user-facing changes. The IAM access review now evaluates only permission sets provisioned in the boundary (#14184)."
			],
			"security": [
				"The 20x standing log access validator no longer reports a false gap for PowerUserAccess, which is intentionally absent in production. Provisioned permission sets still require the explicit log-content deny (#14184)."
			],
			"schemaChanges": ["No schema changes."],
			"pullRequests": [14184],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.23-20x-mla-remediation",
			"date": "2026-10-23",
			"status": "pending deployment",
			"functionality": [
				"No user-facing changes. The release adds the IAM access review evidence needed for 20x standing log access controls (#14181)."
			],
			"security": [
				"Identity Center standard permission sets now carry explicit denies for log-content reads, and the automated access review reports any missing deny. Production evidence collection fails closed when a fetcher fails, so an incomplete set cannot publish as complete (#14181)."
			],
			"schemaChanges": ["No schema changes."],
			"pullRequests": [14181],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.23-20x-remediation",
			"date": "2026-10-23",
			"status": "pending deployment",
			"functionality": [
				"No user-facing changes. The release records the complete 20x KSI method coverage and labels manual methods for assessor review (#14179)."
			],
			"security": [
				"The writer sandbox upgrades Pillow to 13.0.0, removing the three critical Pillow findings reported by Amazon Inspector in the running image (#14179)."
			],
			"schemaChanges": ["No schema changes."],
			"pullRequests": [14179],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.22c-fips-release",
			"date": "2026-10-22",
			"status": "pending deployment",
			"functionality": [
				"No user-facing changes. The release records the FIPS end state in Terraform and the cryptographic module inventory (#13732)."
			],
			"security": [
				"Terraform now records Fargate FIPS-140 mode as enabled in both production Regions, so a later apply of the monitoring root keeps it on (#13732). The app tfvars pin the amd64 images, including the TLS sidecar, for hand applies.",
				"The cryptographic module inventory records the FIPS end state: Fargate storage and agent calls, Terraform-managed Lambdas, and the writer sandbox move to their validated or vendor-stream status, and the remaining gaps are listed (#13732).",
				"The govscrape images move from Node.js 20 to Node.js 24, which rejects certificates that chain to the compromised eMudhra intermediate CAs (#14106)."
			],
			"schemaChanges": [
				"0394 makes cleatus_contracts_compute_hashes run as its owner and revokes EXECUTE on both owner-run trigger functions from PUBLIC, so the restricted load roles can write Contracts (#14094, #14103). It is applied to nonprod and production one file at a time before the deployment."
			],
			"pullRequests": [13732, 14094, 14103, 14106, 14107, 14109],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.22b-node-release",
			"date": "2026-10-22",
			"status": "deployed",
			"functionality": [
				"Staff can see ghost-campaign events on a timeline and calendar in the admin area (#14022)."
			],
			"security": [
				"The web, API, db-bootstrap, writer-sandbox, and FORGE images move to Node.js 24.22.1 and 22.23.4. These releases reject certificates that chain to the eight compromised eMudhra intermediate CAs, which the previous 24.21.0 and 22.23.3 images trusted. They also fix ten Node.js vulnerabilities, including remote code execution in the Brotli decoder (#14096). The OpenSSL FIPS provider stays at 3.1.2 (CMVP #4985)."
			],
			"schemaChanges": ["No new migrations beyond v2026.10.22-fips-release."],
			"pullRequests": [14022, 14096, 14102],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.22-fips-release",
			"date": "2026-10-22",
			"status": "deployed",
			"functionality": [
				"Every GovCloud Fargate task runs on X86_64 instead of ARM64, and the release builds linux/amd64 images, so that Fargate FIPS-140 mode can apply (#13726). Task sizes do not change.",
				"More public-data reads (grant programs, locations, and the wave 4 surfaces, including the home agent's public data tools) come from the public-data service (#13880, #13914, #13922, #14043, #14093).",
				"Enrichment keeps its stage results when only inputs the stage does not read change (#13806), and Legistar attachments link to their agenda items (#14045).",
				"The public-data load alerts when it fails (#14084). The dashboard sidebar loads without the Stripe call (#12273), and contract counts and search totals are bounded (#12865, #14064)."
			],
			"security": [
				"Every production task runs on X86_64 and each production VPC has interface endpoints for the ECR and Secrets Manager FIPS hosts (#13726). After the deployment, Fargate FIPS-140 mode was turned on in both production Regions, and every web, API, and FORGE task reports /proc/sys/crypto/fips_enabled = 1 (#13732).",
				"Every Lambda function that Terraform manages loads the certified Amazon Linux 2023 OpenSSL FIPS Provider (CMVP 5021) through a layer, and the Node.js database audit function runs with --force-fips (#13722).",
				"The production web and API database connection strings rotate through Secrets Manager (#13971). Signatures and screenshots in blob storage are private (#13889). The FORGE runtime image upgrades its Alpine packages (#14085).",
				"Releases are blocked when an image carries a Known Exploited Vulnerability (#10450). Every rejected Server Action is reported (#14060)."
			],
			"schemaChanges": [
				"0391 keeps enrichment stamps when only unread columns change (#13806).",
				"0392 adds an agenda item key to LookupGovEventsDocuments (#14045).",
				"0393 makes the Documents sync trigger function SECURITY DEFINER, so the restricted load roles can write Documents (#14089).",
				"0391 and 0392 were applied to nonprod and production, one file at a time, before the deployment. 0393 was already applied to production on 2026-10-21, and to nonprod before the deployment."
			],
			"pullRequests": [
				10052, 10450, 11434, 12273, 12845, 12865, 13722, 13726, 13785, 13797, 13806, 13880, 13885, 13889, 13895,
				13903, 13906, 13913, 13914, 13915, 13917, 13922, 13942, 13943, 13950, 13956, 13966, 13968, 13969, 13971,
				13986, 13987, 13988, 13989, 13999, 14000, 14001, 14017, 14019, 14020, 14021, 14023, 14024, 14026, 14028,
				14029, 14030, 14031, 14033, 14034, 14041, 14042, 14043, 14044, 14045, 14048, 14052, 14055, 14056, 14058,
				14059, 14060, 14062, 14064, 14065, 14067, 14075, 14077, 14079, 14084, 14085, 14089, 14091, 14092, 14093,
				14095, 14097
			],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.20b-ksi-release",
			"date": "2026-10-21",
			"status": "deployed",
			"functionality": [
				"Deploys everything in v2026.10.20-ksi-release, which was built but not deployed on its own.",
				"The GovCloud public-data load no longer stops on a document or opportunity that commercial re-filed under a new id: it keeps the old row, skips the clashing row and any rows that depend on it, and logs their ids (#13938).",
				"Contract pages read an opportunity from the public tables or the customer tables (#13829).",
				"A self-serve signup that reaches the final step without an organization gets one created instead of an error page (#13891).",
				"The no-rep demo follow-up email no longer goes to a lead a rep dismissed (#13955), the founder structured data uses the current Crunchbase profile URL (#13937), and the event scout keeps to events that sell to government (#13974)."
			],
			"security": [
				"The shared developer login is removed from GovCloud production, db-bootstrap no longer seeds it, and Terraform deletes its unused password secrets (#13936).",
				"A signed-in session whose user or organization no longer exists ends cleanly instead of failing on every request (#13891).",
				"The MCP TypeScript SDK moves to 1.32.1, which fixes high advisories GHSA-22jm-h49p-29qw and GHSA-6qxp-vccf-f47h and removes their baseline entries, and Vite moves to 6.4.4 (#13955).",
				"The new SupportReports table is classified as federal customer data, and a user's reports are deleted with the user (#13970)."
			],
			"schemaChanges": [
				"0389 creates the SupportReports table for customer bug reports and feedback, and 0390 indexes it (#13970). No code reads or writes the table in this release.",
				"Before deployment, three trigger definitions that GovCloud production lacked were restored from commercial (contracts_compute_hashes, contracts_compute_search_vector, notices_compute_hashes; GovCloud was baselined at migration 0233, after the migrations that create them). Migration 0385, which had failed on their absence, was then applied."
			],
			"pullRequests": [13829, 13891, 13936, 13937, 13938, 13955, 13970, 13972, 13974],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.20-ksi-release",
			"date": "2026-10-20",
			"status": "deployed",
			"functionality": [
				"Settings, Security, for the organization Owner and Admins: set the session inactivity window for every member, list and end member sessions, list and revoke connector (MCP) authorizations, and compare the organization settings with the Secure Configuration Guide (#13719).",
				"Sign-in supports passkeys and authenticator apps, and whitelabel sign-in pages show the tenant brand (#13772, #13890).",
				"Staff can review a user's sign-in methods, sessions, and lockouts from the admin login page (#13756).",
				"Search and the Recommended feed filter contracts by NSN and FSC/PSC, and grant program pages show program details and filters (#9851, #9852, #12510, #13877).",
				"The requirements agent replaces the 12-area requirements extraction (#13865).",
				"Recommendations generate in a separate scheduled job with neural pair scoring (#13859, #13860, #13886, #13908).",
				"New and repaired public-data scrapers, OCR and document conversion fixes, CRM record pages, and writer and Forge reliability fixes (see the pull request list)."
			],
			"security": [
				"A Customer Admin can shorten the session inactivity window for every member of the organization to 5 or 10 minutes. The server ends a session that is idle past the window on its next request. Owner and Admin sessions keep the 10-minute limit, and every session still ends 12 hours after sign-in (#13719).",
				"A Customer Admin can end a member session and revoke a connector authorization. Each change writes an audit log entry (#13719).",
				"Only an organization Owner or Admin can create or revoke an entity API key (#13719).",
				"The organization security settings export reports the session inactivity window and compares it with the Secure Configuration Guide (SCG-03) (#13719).",
				"Users can add a passkey or an authenticator app as a sign-in factor (#13772).",
				"Whitelabel hosts block self-serve signup and the routes outside the whitelabel allow-list under Better Auth (#13890).",
				"Staff can sign a user out everywhere, release lockouts, and reset multi-factor authentication from the admin login page, each behind a confirmation (#13756).",
				"Staff API tokens carry scopes (#13520).",
				"Production secret rotation is on for the ingest, customer-sync, and app token secrets, the web and api database URLs rotate between two roles, a monitor reports secret age, and shared secrets replicate to the standby region (#13807, #13837, #13845).",
				"Amazon Inspector findings close after each processed assessment run (#13582).",
				"SIEM agent traffic travels over FIPS-validated TLS (#13724).",
				"Deleted customer document versions expire after the retention window (#13679).",
				"Cron containers disable core dumps, and the follow-redirects dependency moves to 1.16.1 (#13730, #13934, #13945)."
			],
			"schemaChanges": [
				"0378 adds the internal artifact library tables and columns, and 0379 indexes them.",
				"0380 adds the InternalArtifactTokens.scopes column.",
				"0381 adds the InternalArtifactViews.lastSeenAt column.",
				"0382 adds the Organizations.sessionIdleMinutes column.",
				"0383 adds four neural classification columns to EntityContractScores.",
				"0384 and 0385 create the customer opportunity tables and their triggers.",
				"0386 adds the Pursuits.opportunitySource column.",
				"0387 creates the writer evaluation tables, and 0388 indexes them."
			],
			"pullRequests": [
				9851, 9852, 12381, 12510, 12855, 12898, 12922, 13056, 13070, 13155, 13202, 13203, 13215, 13260, 13294,
				13361, 13450, 13456, 13520, 13557, 13558, 13582, 13621, 13670, 13679, 13680, 13681, 13682, 13685, 13686,
				13687, 13688, 13692, 13694, 13696, 13697, 13698, 13699, 13700, 13701, 13702, 13703, 13704, 13705, 13706,
				13707, 13708, 13709, 13710, 13712, 13714, 13715, 13716, 13717, 13718, 13719, 13720, 13721, 13723, 13724,
				13725, 13727, 13729, 13730, 13731, 13734, 13735, 13736, 13737, 13738, 13740, 13741, 13743, 13745, 13747,
				13749, 13750, 13751, 13755, 13756, 13762, 13764, 13766, 13767, 13770, 13771, 13772, 13773, 13775, 13776,
				13778, 13779, 13780, 13781, 13782, 13783, 13784, 13787, 13788, 13790, 13791, 13793, 13794, 13795, 13798,
				13799, 13800, 13801, 13802, 13803, 13805, 13807, 13809, 13810, 13813, 13816, 13818, 13822, 13828, 13832,
				13835, 13837, 13841, 13845, 13851, 13853, 13856, 13857, 13858, 13859, 13860, 13862, 13863, 13864, 13865,
				13868, 13869, 13870, 13871, 13872, 13873, 13875, 13876, 13877, 13878, 13879, 13884, 13886, 13890, 13892,
				13893, 13896, 13897, 13898, 13900, 13904, 13908, 13909, 13912, 13921, 13923, 13925, 13934, 13945
			],
			"guideVersion": "1.5.0"
		},
		{
			"release": "v2026.10.17b-ksi-release",
			"date": "2026-10-17",
			"status": "deployed",
			"functionality": [
				"Automated evidence collection adds a second method for nine key security indicators (#13676)."
			],
			"security": [
				"The production egress allowlist adds www.cleat.ai and us.api.knowbe4.com for the new evidence collectors (#13676).",
				"Every pull request runs a dependency vulnerability scan and an end-to-end smoke test before merge (#13674).",
				"Source maps upload to PostHog after the deploy instead of before it (#13660)."
			],
			"schemaChanges": [],
			"pullRequests": [13660, 13663, 13668, 13669, 13674, 13676, 13678],
			"guideVersion": "1.4.0"
		}
	]
}