Release notes

Cushy ships in rounds. These notes summarize what is real today and what is next.

R4 — FinOps core (2026-07-19)

• Billing ingestion normalized to the FOCUS standard for all four clouds, reconciling to source to the cent.
• Spend by cloud, service and tag with an explicit untagged bucket; a daily trend.
• Budgets with ok / warn / breached evaluation.
• Statistical anomaly detection (mean + 3σ over the trailing 28 days) with full attribution, audited once.
• New endpoints: GET /api/finops/cost, POST /api/finops/ingest, GET/POST /api/finops/budgets, PATCH/DELETE /api/finops/budgets/{id}.

R3 — RBAC, ownership & API tokens

• A fixed role-to-capability model enforced on every mutation with honest, audited 403s.
• Capabilities recomputed per request, so downgrades bite without re-login.
• Organization ownership: first registrant is owner; MFA-gated transfer.
• cc_pat_… API tokens with a role ceiling, expiry, one-time secret, last-used tracking and revocation.

R2 — Cloud connections engine

• Real AWS (STS AssumeRole + SigV4) and GCP (workload identity federation + Asset Inventory) adapters.
• Health checks with exact missing permissions; non-destructive disconnect; duplicate detection.
• A sync engine driven by cron, connect-kick and on-demand passes, with token buckets, delta cursors and soft-delete reconciliation.
• The empty-to-real cutover with per-section provenance and freshness.

R1 — SSO & login hardening

• OIDC bring-your-own identity provider: per-org config with discovery, an encrypted client secret, PKCE (S256), RS256 ID-token verification and JIT provisioning.
• The 5-attempt login lockout (and MFA-code cap), enumeration-safe and audited.
• TOTP MFA with one-time recovery codes; enumeration-safe password reset.

Later rounds (2026-07)

• Monitoring & incidents — alert rules, deduplicated firing/auto-resolve, correlated incident timelines, per-employee activity; plus per-resource metrics telemetry (connect a Prometheus-compatible collector endpoint per resource).
• Terraform execution engine — native-HCL composition, plan → policy/cost → approval (per-workspace separation of duties) → apply-the-saved-plan, encrypted state + rollback, drift, import/adopt of any discovered resource (IAM included), workspace folders with edit-from-Inventory, output bindings between workspaces, and the GitOps hydrated repo. A real OpenTofu runner (opt-in per account, short-lived write credentials, all four clouds wired) and an async worker with real plan diffs.
• All four clouds — real Azure and Alibaba adapters at AWS/GCP parity, cross-cloud site-to-site VPN across all six pairs, a draw-a-connector topology editor, and a provider-aware network reachability engine.
• Pipelines — the deploy control plane for applications and infrastructure (real Terraform lifecycle with a second-operator approval pause on production).
• SAML 2.0 + SCIM 2.0 — bring-your-own SAML IdP, SCIM provisioning/deprovisioning, IdP group-to-role mapping.
• Support — tickets with severities/SLA snapshots, live chat, encrypted attachments; the staff support desk.
• AI assistant — real model calls grounded on your org's infrastructure, RAG over prior Q&A, image attachments.
• Blueprint catalog — native .tf blueprint folders synced from Git, org-own custom blueprints, and vendored Terraform Registry imports.

On the roadmap

Account vending, marketplace, SLO/error budgets, cost recommendations/chargeback, Kargo-style freight/promotion, and SAML SLO. See Feature status & roadmap for the honest status of each surface.