Releases

Push dashboard actor/state predicates into SQL instead of JS

loadMyMatters, loadMyTasks, and loadBilling each fetched every active matter, every task, or every permitted invoice tenant-wide, then filtered to "mine" or "concept" in JS. Work grew with unrelated tenant records instead of the actor's own slice.

#95169736e6

Give periodic jobs stable jobIds so replicas don't double-enqueue

apps/workers/src/main.ts kept cron state in a process-local Map and ticked on its own setInterval. Every enqueue() call passed only (queue, name, payload), no stable jobId, so BullMQ-level dedup never applied.

#9570a11e41

Retry-then-log indexing failures on matter/relation create

createMatterCommand and createRelationCommand committed the durable row in a transaction, then awaited indexMatter/indexRelation outside it with no error handling.

#9544f76d07

Enforce deadlineAt as a real timeout on both model-gateway adapters

Both adapters validated that deadlineAt was present but never derived an actual timeout or AbortSignal from it. post() only ever forwarded the caller's own abortSignal; nothing was wired from deadlineAt.

#9557694712

Restore-verify actually restores into a scratch database

CI's "Restore-verify" step provisioned demo-kantoor, then immediately ran restore-verify.mjs against that same live tenant database. No backup, no restore, no scratch database, it just re-counted tables and roles in the database it had just created and called that "verified".

#9534fe41b7

Raise LiteLLM's memory limit again, GitHub runner OOM-killed it at 1G

The model-gateway-conformance job (BLI-1392) hit the same exit-137 OOM-kill this container's memory limit was already tuned once for, this time on the GitHub-hosted CI runner rather than local Docker Desktop: litellm died ~8s after starting, before its healthcheck ever got a…

#961609885c

Populate invoiceById before reading it in the WIP hour scan

buildWipRealizationReport ran scanActiveMatterHours before scanActiveMatterInvoices.

#95040a947f

Bridge Helm's *_HOST vars to the *_URL vars factories read

The chart set VALKEY_HOST/OPENSEARCH_HOST; the factory functions read REDIS_URL/OPENSEARCH_URL and silently fell back to in-memory adapters when those were absent, in every environment including production, no error, no signal.

#9467ec5298

Cover MODEL_GATEWAY_PROXY_URL in the EU-residency gate

The runtime reads MODEL_GATEWAY_PROXY_URL, but the residency gate only mapped MODEL_GATEWAY_URL, so the proxy key fell through to the generic "uncovered" warning and a non-EU value never failed validate-residency.

#938610bf2a

Fail closed in production on dev login previews and mock SMTP

shouldExposeDevMagicLink returned a usable token whenever the relay was mock or PORTAL_SHOW_DEV_MAGIC_LINK was set, with no check of the runtime profile. requestLoginLink put that token straight into the response returned to the browser, and defaulted PORTAL_BASE_URL to…

#9525e4a53a

Derive MCP create_matter flavor enum from MATTER_FLAVORS

The MCP create_matter proposal schema hardcoded a 4-value flavor enum ('legal', 'debt_collection', 'insolvency', 'roll'), missing tax_law and general that MATTER_FLAVORS already has and that api-contract's HTTP schema already accepts (and drift-guards).

#9498f1ce96

Invalidate in-flight acquisitions on evict, await disposal at shutdown

evict(key) only ever touched #live.

#948d676583

Revalidate tenant status at each mutating action, not just on pool miss

getTenantHandleForSlug only checked route.status !== 'active' inside the resource pool's cache-miss create callback.

#9472fe3548

Count distinct identifiers newly anonymized per gateway invocation

anonymize() mutates and returns the same mapping reference it was given, and mapping.size is cumulative across the whole mapping, not a per-call delta. anonymizedCount += result.mapping.size - opts.mapping.size was therefore always x-x=0 when a caller supplied a mapping…

#944734cdda

Reject transport redirects on the model-gateway adapters

Both the LiteLLM and direct (Anthropic) adapters approved a configured base URL, then relied on fetch's default redirect-following behavior on the shared post() call.

#943741cb57

Detect content-filter refusals on LiteLLM's non-streaming path

The streaming path already treats finish_reason: 'content_filter' as a refusal.

#942a633f60

Tolerate a withdrawn custom-select option on unchanged resave

MatterOverviewEditor always resends the full customValues map, including fields the user didn't touch. updateMatterCommand rejected any select value no longer in the field's current options — including a value that was valid when saved and is simply being resent unchanged —…

#9413390412

Add billing:write scope so billing integrations can write invoices

apps/web/src/lib/api/scopes.ts declared billing:read but no billing:write, so every billing-family write had to borrow a scope from another module. matter.legal-aid.save (PUT /api/v1/matters/{id}/legal-aid) declared matters:write even though it gates on can(update, invoice) — a…

#9398fe6df8

Cross-framework design system on Ark UI — POC foundation

BLI-1694#926e3f6919