Pipavia Join the waitlist

Release log

What shipped, and how it was tested.

Every Conduit release — the Filings connector and the Router — with what changed and the testing record behind it. This page is the public record, and it is updated as part of each release.

Router v1.2.6 — Connect never takes the page away

2026-10-15

Release candidate since 2026-10-15 — graduates 2026-10-22, after a one-week live soak under watch and the release gate's own browser re-proof of the Connect journey.

  • Round 3 of the Connect fix (rounds 1 and 2 are the entries below — each fixed what its tests could see, and each was caught by a harsher proof). The pattern across all seven real-browser runs on record: every run that reached Connect's automatic fallback — an old-style form sign-in the page submitted on its own when requests stalled — froze the tab, because that form posts to the same stalled address and the move never completes. Every run that ended on an actual answer finished fine. So the page no longer navigates itself, ever: when every way stalls, Connect ends with words on screen, keeps your key, stays alive for another try, and offers the plain sign-in as a button you choose to click.
  • The session sign-in (the way that answers on bad networks) now gets a second attempt at the end of the rotation, for networks that stall only sometimes. The overall limit is 40 seconds, as a backstop.
  • The verdict rules stand unchanged since v1.2.4: only the answer to a request that carried your key can judge it, and a refusal is the only result reported as "not accepted".

Testing

  • Release gate on this batch: machine pass PASS (0 secrets, 0 known vulnerabilities across 174 dependencies) and deep review of the change — PASS, recorded in PR #46. The gate's identical browser re-proof is the graduation step for this candidate.
  • Suites: gateway 195/195, adapter 74/74. The dashboard test suite is now 10 tests; the 2 round-3 tests (Connect never navigates on its own and offers the button; the page stays alive for a second attempt) fail on v1.2.5 and pass here. Writing them caught a real fault in this batch before it shipped — the ending message could have been silenced by its own guard — fixed and recorded in the release notes.
  • Live proof after deploy: /health reports 1.2.6; the served dashboard carries the new logic. In a real browser on a network where this time every request stalled, the journey behaved exactly as designed: progress words while it worked through the ways, then at ~40 seconds the final plain message — "your key was not checked" — with the plain-sign-in button offered, the key still filled in, and the page responsive at every check. (On a network that answers, the same flow connected in ~10 seconds in the v1.2.5 proof below.)
  • Still open, listed openly: two low findings are carried (a second web address also serves the gateway; the dashboard shows paid-tier cards to trial keys whose saves the server then refuses), and the paid-claim proof item (low) closes with the Paddle teardown.

Verifier record

Evidence: merged as PR #46, merge commit 356320e3ffbf5171dcdecae04ea2ac9773d03a53. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.2.5 — Connect leads with the way that answers

2026-10-15

Correction (2026-10-15): this batch did not become a release candidate. It passed the building team's browser proof (recorded in its Testing section below), then FAILED the release gate's own browser re-proof — the attempt advanced once, then the tab froze and the 30-second limit's message never appeared — so candidate registration was withheld and the finding stayed open. It is superseded by v1.2.6 above. The original entry follows, unedited except for this notice.

Release candidate since 2026-10-15 — graduates 2026-10-22, after a one-week live soak under watch and the release gate's own browser re-proof of the Connect journey.

  • Round 2 of the Connect fix (the v1.2.4 entry below tells round 1 — and why it was not enough). The pattern across every test on stall-prone networks: a request that carries your key inside a form-style post answers quickly, while requests that carry it in a header or in the address are the ones that stall. Connect now leads with the session sign-in — the key travels once, in that post — and its follow-up check carries no key at all. The older ways remain only as fallback, on shorter fuses.
  • Connect can no longer sit silent: a 30-second limit ends every attempt with words on screen — connected, refused, or "your key was not checked" — even if the network swallows every answer, and a late answer for a finished attempt is ignored.
  • A timing fault is fixed: the page's own start-up check could finish late, mid-connect, and clear the key or switch screens under your own attempt. Once you click Connect or Disconnect, that check stands down.
  • Round 1's rules stand unchanged: only the answer to a request that carried your key can judge it, and a refusal is the only result reported as "not accepted".

Testing

  • Release gate on this batch: machine pass PASS (0 secrets, 0 known vulnerabilities across 174 dependencies) and deep review of the change — PASS, recorded in PR #45. The gate's identical browser re-proof is the graduation step for this candidate.
  • Suites: gateway 194/194, adapter 74/74. The dashboard's own page script is tested against simulated bad networks in a 9-test suite: the 3 new round-2 tests (sign-in-first order; a wedged connection whose cancel never lands, ended by the 30-second limit; the start-up check standing down) fail on v1.2.4 and pass here; the 6 round-1 tests still pass.
  • Live proof after deploy: /health reports 1.2.5; the served dashboard carries the new logic; and the full journey was completed in a real browser — a fresh trial key connected at the first check (~10 seconds), a deliberately wrong key then received the exact "not accepted" answer, and the page stayed responsive throughout.
  • Still open, listed openly: two low findings are carried (a second web address also serves the gateway; the dashboard shows paid-tier cards to trial keys whose saves the server then refuses), and the paid-claim proof item (low) closes with the Paddle teardown.

Verifier record

Evidence: merged as PR #45, merge commit 8747abce0a7c10e7058683234bc8fe3b6feca933. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.2.4 — Connect can no longer convict a good key

2026-10-15

Correction (2026-10-15): this batch did not become a release candidate. It fixed the false-rejection logic and passed its scripted tests, then FAILED the release gate's real-browser re-proof — on a stall-prone network Connect still hung without an answer — so candidate registration was withheld and the finding stayed open. It is superseded by v1.2.5 above. The original entry follows, unedited except for this notice.

Release candidate since 2026-10-15 — graduates 2026-10-22, after a one-week live soak under watch and a fresh browser re-proof of the Connect journey.

  • Found by our own release gate's re-test in real browsers: on networks that stall some requests, the dashboard's Connect could tell a customer "That key was not accepted" for a key that was perfectly valid — and once it had happened, a retry could fail instantly the same wrong way. The key was never the problem: one of the ways Connect tried to send the key carries no key at all, and its failure was being read as a refusal.
  • Connect now judges a key only by the answer to a request that actually carried it. A refusal — the router saw the key and said no — is the only result reported as "not accepted".
  • If the service is busy or a sign-in does not take, Connect now says so plainly — your key was not checked — and keeps the key ready for another try, instead of blaming the key.
  • The session sign-in now runs as a sign-in: the cookie way of connecting switches on only after the sign-in succeeds and a follow-up check confirms it — not before.
  • While Connect is working, the page now says what it is doing instead of sitting silent.

Testing

  • Release gate: the 2026-10-15 re-run returned BLOCKED on this finding (high) after reproducing it twice in real browsers; this fix batch's own gate run — machine pass PASS (0 secrets, 0 known vulnerabilities across 174 dependencies) and deep review of the change — returned PASS, recorded in PR #44. The earlier v1.2.3 entry below predates the re-run verdict.
  • Suites: gateway 191/191, adapter 74/74 — including a new 6-test suite that runs the dashboard's own page script against simulated bad networks (stalls, busy answers, a cookie way left over from a previous try). The 3 tests covering the false-rejection cases fail on the previous version and pass on this one.
  • Live proof after deploy: /health reports 1.2.4; the served dashboard carries the fixed logic; a fresh trial key signed in and read its usage over the session cookie, and a wrong key was refused.
  • Still open, listed openly: two low findings are carried (a second web address also serves the gateway; the dashboard shows paid-tier cards to trial keys whose saves the server then refuses), and the paid-claim proof item (low) closes with the Paddle teardown. (The browser re-proof mentioned here when this entry was written has since been run: it failed — see the correction at the top of this entry.)

Verifier record

Evidence: merged as PR #44, merge commit 79627e781e8577af98214aabbd402fd73bbd160b. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Conduit (Filings connector) — OAuth registration: stricter addresses, a consent screen that names the destination

2026-10-15

Release candidate since 2026-10-15 — graduates 2026-10-22, after a one-week live soak under watch.

  • Redirect addresses that break the OAuth rules are now refused at client registration: an address with a fragment (a # part) or with credentials embedded in it is rejected, on top of the existing https-only (or loopback http) rule. Clients registered earlier whose address would fail today's rules are refused at the sign-in step as well.
  • The consent screen — the page where a key holder approves a client — now shows where approval actually sends them: the redirect hostname in bold and the full address, plus a plain-words warning that anyone can register a client, that the client's name is whatever its operator typed, and that Conduit has not verified who runs it.
  • By design, client registration stays open and unauthenticated: that is the OAuth dynamic client registration model the MCP specification uses (it is how standard MCP clients connect). Its controls are the address rules above, mandatory PKCE (S256), a cap of 20 registrations per address per hour, and the consent screen as the point where a human decides.

Testing

  • Release gate: PASS WITH FINDINGS, recorded in PR #68 — the audit covered registration, the consent page, code and token handling end to end; the findings this entry solves were rated medium (consent screen) and low (address rules).
  • Suite: 177/177, including 3 new regression tests proven to fail on the previous code first.
  • Attacker-view probes against the deployed server: a registration fuzz set (fragment, embedded credentials, non-loopback http, malformed and oversized inputs) — every invalid case refused, normal and loopback registrations working; consent-page content proof on the served page; token-binding probes (wrong PKCE verifier, replayed code, mismatched redirect address) all refused; a fresh free key fetched real SEC EDGAR data.
  • One item stays open, listed openly: authorization-code single-use and token revocation take effect across the network within about a minute rather than instantly — a property of the current data store (low). It closes with the planned move to a transactional store.

Verifier record

Evidence: merged as PR #68, merge commit 9ac77e32faa68ee2df88b4a1a601295065b19424. Verify what shipped: the public repository's commit history is the evidence trail for this connector — the merge commit above is the reference for exactly what changed.

Router v1.2.3 — Security fix: a registry id is not a credential

2026-10-14

  • A release-gate finding is solved: a registry row without an issued token can no longer authenticate by its raw id. Keys now resolve by their stored token hash only — regression-tested on both cache paths. Before the change, the production registry was audited first: 1 row, none tokenless.
  • The README now points to the privacy and deletion path.

Testing

  • Release-gate machine pass: PASS — 0 secrets, 0 known vulnerabilities across 174 dependencies, all MUST checks pass (verdict recorded in PR #43).
  • Suites: gateway 185/185, adapter 74/74; the SDK and CLI verifier suites are green.
  • Live proof after deploy: /health reports 1.2.3; a raw registry id presented as a credential returns 401; a fresh trial key and the dashboard session flow both work.
  • One router finding stays open, listed openly: F2, paid-claim proof strength (low) — it closes with the Paddle teardown.

Verifier record

Evidence: merged as PR #43, merge commit 19bd611b89ad3b8a4bdda36377156b8acc4a1e36. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.2.2 — The dashboard explains itself

2026-10-14

  • The Connect card now says it in plain words: “Your Conduit key is your login — there is no password. Everything you save here (your provider keys, your spending rules, your receipts) is kept under your Conduit key.”
  • One-line explanations added to the Usage and Try-a-call sections; the provider-keys section now says your keys are saved under your Conduit key in encrypted storage; the footer shorthand is spelled out.
  • Words only — no behaviour changed.

Testing

  • Full local CI battery green: gateway suite 185/185; lint, typecheck, catalog and licence checks, and the adapter, SDK, CLI, verifier and Python suites all pass.
  • Release-gate machine pass: PASS — no must-gate failures, 0 secrets in code, 0 known vulnerabilities (recorded in PR #42).
  • Live probes after deploy: /health reports 1.2.2, and the served dashboard carries the new login line.

Verifier record

Evidence: merged as PR #42, merge commit bc61508a293727013403a531f77dd1db67053046. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Filings v0.7.0 — Pro and Team tiers repriced

2026-10-14

  • Pro is now $58/month with 100,000 calls/month (was $29 with 10,000). Team is now $198/month with 1,000,000 calls/month (was $99 with 100,000). Free is unchanged at 100 calls/day.
  • Same tools and data on every tier — volume is the only difference.

Testing

  • CI green on the merge (PR #59); the deploy completed and pipavia.com was verified live serving the new prices and quotas.
  • Release gate: PASS WITH FINDINGS — no critical, no high. Suite 168/168. Live journey proven: a fresh key called the tools and real SEC data came back. 8 low findings — six solved, two still open; both states are listed in the solved notes below.
  • Gate findings — solved 2026-10-14 (PR #64, merge commit 71289b582726beec65706211e5f63912a129ec15): L1 the master-key comparison is now constant-time (hashed, timing-safe); L4 unexpected errors now return a generic message, with the internals kept server-side; L5 the privacy page names Stripe as the payment processor; L6 the privacy page discloses that page fonts load from Google — the visitor's IP address is sent to fetch them, and no cookies are set; L7 requests to the SEC now identify themselves with the pipavia.com contact; L8 client registration is now rate-limited per address. Still open, listed openly: the /admin key-in-address item (low — a documented owner decision, ADR-0006) and a claim-race residual (low — it closes with the planned move to a transactional store).

Verifier record

Evidence: merged as PR #59, merge commit 979591463a6d361471ecd49d629a5f2d79664632. The family's public verification artifacts: the public verifier, the published anchors, and the anchor public key.

Filings v0.7.0 — Stripe billing rail

2026-10-14

  • Stripe is now a payment rail for Conduit subscriptions. A signed-in key can start a Pro or Team checkout; the Stripe webhook — signature-checked, with a 300-second freshness window and duplicate events ignored — grants the tier when a subscription starts or changes, returns the key to free when the subscription is cancelled (the key is never deleted), and records the branded receipt when an invoice is paid.
  • If Stripe is not configured, the new endpoints answer 503 and every other surface is unchanged.

Testing

  • 11 new Stripe billing tests: signature and freshness, park-and-claim, direct-bind grant, Team quota, revocation on past-due and on deletion, receipt amount matching the plan price, dedupe, checkout parameters, and the auth and config gates.
  • Full worker suite 168/168 green; all four billing simulations pass; lint clean (PR #58).
  • Release gate: PASS WITH FINDINGS — no critical, no high. Suite 168/168. Live journey proven: a fresh key called the tools and real SEC data came back. 8 low findings — six solved, two still open; both states are listed in the solved notes below.
  • Gate findings — solved 2026-10-14 (PR #64, merge commit 71289b582726beec65706211e5f63912a129ec15): L1 the master-key comparison is now constant-time (hashed, timing-safe); L4 unexpected errors now return a generic message, with the internals kept server-side; L5 the privacy page names Stripe as the payment processor; L6 the privacy page discloses that page fonts load from Google — the visitor's IP address is sent to fetch them, and no cookies are set; L7 requests to the SEC now identify themselves with the pipavia.com contact; L8 client registration is now rate-limited per address. Still open, listed openly: the /admin key-in-address item (low — a documented owner decision, ADR-0006) and a claim-race residual (low — it closes with the planned move to a transactional store).

Verifier record

Evidence: merged as PR #58, merge commit 00c2eaf6aa4430670c0e1edf54d04d43c74053eb. The family's public verification artifacts: the public verifier, the published anchors, and the anchor public key.

Router v1.2.1 — Gemini 3 models are the default for new keys

2026-10-14

  • Google returns 404 for the Gemini 2.5 models on API keys created after its new-user cutoff. The catalog now carries the Gemini 3 line — gemini-3.1-pro-preview, gemini-3.8-flash, gemini-3.5-flash-lite, priced from Google's pricing page (read 2026-10-14) — and the 3.x models are the defaults in the task profiles, the trial setup, and the examples.
  • The 2.5 models stay in the catalog for keys that still have access to them.

Testing

  • Full local CI battery green, gateway suite 185/185.
  • Live probes after deploy: /health reported 1.2.1; the model list serves gemini-3.5-flash-lite as a free model; a fresh trial key's policy carries the new default.
  • Release gate: PASS WITH FINDINGS — 3 low, none higher. Gateway suite 185/185, adapter suite 74/74. Key protection traced end to end and proven live: provider keys exist only as ciphertext, are decrypted only at call time, and never appear in responses, logs, or audit records.

Verifier record

Evidence: merged as PR #41, merge commit dd2393cc3854adc7bd9b60c3d3487c2ec7176ea3. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.2.0 — Dashboard session sign-in

2026-10-14

  • Connect no longer depends on requests that carry your key. You post the key once; the gateway answers with a sign-in cookie (HttpOnly, valid 12 hours) and every later call uses the cookie, with no key material on the request. Disconnect clears it, and a plain form sign-in is there as the final fallback.
  • Why: on the phone that reported the problem, no-key requests answered and trial keys minted, but any request carrying the key stalled — in both browsers. The session path uses the request shape that always worked from that phone.

Testing

  • Full local CI green: gateway suite 185/185, including 11 new session tests (issue, expiry, tampered-cookie refusal, forged-header refusal, form redirects, sign-out).
  • Live-page proof: the real dashboard was loaded from the live site, Connect was clicked with a real trial key, and it connected through the new session sign-in — then confirmed working on the phone that reported the problem.

Verifier record

Evidence: merged as PR #40, merge commit 7b5633a69eddfbab3efe9d05244e07dc2262ce4e. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.1.1 — Connect accepts the key three ways

2026-10-14

  • The gateway now also accepts your Conduit key as an X-Conduit-Key header or a ?key= query parameter (Authorization stays the primary), and the dashboard rotates through the three shapes and keeps the one that answers for the whole session.

Testing

  • Verified live after deploy: all three key shapes answered 200; a wrong key was refused with 401.

Verifier record

Evidence: merged as PR #39, merge commit 4c4b32146438d18e15999788ecd5aa183d0b1fa8. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.1.0 — The release-gate fixes batch

2026-10-14

  • Privacy: a public data-practices page at /privacy, linked from the dashboard footer, with the operator's deletion checklist published alongside it. Every statement on it matches the real data inventory.
  • The gateway now redirects http to https itself and sends HSTS on every response, instead of depending on zone settings.
  • Streamed replies pass the same key-material scan as plain replies, through a rolling hold-back so a key split across chunks is whole before any part is released; a hit fails the stream closed. Provider redirects are followed by hand (3 hops at most) and every hop is re-checked — no downgrade, no local or private targets. Provider error text no longer reaches you; only the provider's structured error tag (type, code, status) is shown.
  • Streamed calls are metered from the usage the provider reports, even when a stream fails midway; a client disconnect now stops the generation; reply size caps are enforced during the read; more SSRF address classes are blocked; the billing webhook gained a 300-second freshness window; and the dashboard keeps your key in session storage unless you tick “Remember this device”.

Testing

  • This release is the router half of the 2026-10-14 release-gate findings pack (F-03–F-20); each fix is pinned by regression tests in the suite, including tests that fail on the old code.
  • Machine release-gate re-scan of the merged release: PASS (2026-10-14).

Verifier record

Evidence: merged as PR #38, merge commit 300772be8079fbf0c4fa76d2a32b743f4dbc7fd9. Gate evidence: the 2026-10-14 release-gate findings pack and the post-release machine re-scan. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.0.1 — Security fix: the adapter side door is closed

2026-10-13

  • The adapter worker's invoke routes now require the gateway↔adapter shared secret — compared in constant time and checked before the request body is read — and the adapter's public workers.dev route is disabled. Calls can only arrive through the gateway: under your policy, inside your budget, and with a receipt.
  • The dev-only DeepSeek lane is out of the production adapter map; it exists only where a deployment explicitly opts in.
  • The adapter's /health now reports its real version instead of a stale one.

Testing

  • Regression tests pin a 401 for missing or wrong secrets on both invoke routes, and for the unconfigured case: no secret set means every invoke is refused.

Verifier record

Evidence: merged as PR #24, merge commit a20de9ab9bbb2c61be9233ef5cd327ccd0b82239. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Router v1.0.0 — Launch hardening

2026-10-13

  • Every surface — gateway, adapter, both SDKs, the CLI, the docs — was re-read end to end and brought true. Audit-chain positions are now assigned by the store itself, so two calls landing in the same moment can no longer overwrite each other's record, and an anchor refuses to sign over an unverified chain.
  • Per-call overrides can only narrow your standing rules: a call can no longer raise its own budget, pin a model outside your allowlist, declare fallbacks your rules do not admit, or switch on the dev profile.
  • More SSRF forms blocked at registration and at egress; the documented kill switch (POST /admin/kill) now exists as a real route; a provider reply that echoes your own key back fails closed instead of being relayed.

Testing

  • 147 gateway tests and 52 adapter tests green, plus the SDK, CLI, Python and verifier suites.
  • The spec's ten release-gate features were run as behaviour tests against production after the deploy.

Verifier record

Evidence: merged as PR #23, merge commit 284ce234479f20f6557996a2eaa14f762897400b. Verification machinery: every routed call on this release is receipted and anchored — verify any receipt at the public verifier; the anchors and the anchor public key are published.

Filings v0.7.0 — OAuth 2.1 sign-in and the canonical address

2026-10-12

  • An OAuth 2.1 authorization server now sits in front of the key system: authorization code with PKCE, dynamic client registration, rotating refresh tokens, and revocation. A token points at your linked key — same tier, quota, and scopes — and master keys cannot link.
  • The canonical endpoint is now https://mcp.pipavia.com/mcp; the workers.dev origin stays live during the transition. Unauthenticated calls to /mcp now carry the standard resource-metadata challenge.
  • This is the version listed in the Claude Connectors Directory, approved 2026-10-12.

Testing

  • 151 worker tests, including 14 new OAuth tests: metadata shape, the challenge header, registration validation, the full PKCE flow, token-to-account mapping, rotation, and revocation.

Verifier record

Evidence: merged as PR #46, merge commit d6bd482bf90be225952ff0b5dbc0922446634b9c. The family's public verification artifacts: the public verifier, the published anchors, and the anchor public key.

Earlier releases

Filings v0.1.0–v0.6.0 (the September 2025 build-out: the first five tools, the full 24-tool set, self-service keys, the owner dashboard) and Router v0.2.0–v1.0.8 are recorded in the project changelogs — Filings connector changelog · Router changelog. Day-to-day product changes are on the Changelog page.