Releases

Added

• -Secret reference resolution for JWT, OIDC, and upstream TLS material, including filesystem-backed secret loading and runtime validation.
• -Upstream mutual TLS support with client certificate and key pairing, runtime secret and upstream TLS inventory in the admin snapshot, and typed audit events for secret and mTLS material changes.
• -Metrics for secret lifecycle activity and upstream mTLS reload outcomes, plus operational documentation for secret and certificate rotation.

Changed

• -The product's user-facing branding was renamed from Spooky to Impulse across runtime help text, packaging descriptions, sample configs, and documentation.
• -Release, packaging, Docker, and top-level docs were refreshed so the public product surface now reads consistently as Impulse.

Fixed

• -Resolved upstream TLS material is now frozen into runtime transport configuration so rotated clients do not silently pick up certificate changes outside generation activation.
• -Secret resolution now honors configured default providers and base directories, upstream client certificate expiry is normalized into runtime state, and the mislabeled upstream mTLS handshake metric was removed in favor of correct TLS outcome reporting.
• -HTTP-only upstreams skip unnecessary TLS material resolution, self-signed listener rotation tests were hardened, and the remaining build and clippy issues in this release line were cleaned up.

Compatibility

• -This release is additive for deployments that do not use secret references or upstream client certificates, but the new secret and mTLS configuration fields require an Impulse 0.6.0-beta runtime or newer.

Added

• -Prometheus recording rules, production alert rules, SLO definitions, and six Grafana dashboards under deploy/observability/.
• -Canonical admin audit correlation fields including event_id, schema_version, request_id, trace_id, span_id, listener, and failure_class.
• -Runtime observability metadata on GET /admin/runtime, including contract version, audit schema version, backend health summaries, and documentation references.

Changed

• -The Debian package now ships the control API disabled by default instead of exposing a weak placeholder credential.
• -The systemd unit was tightened with stronger restart policy, higher file-descriptor limits, and stricter sandboxing defaults.

Fixed

• -OTLP tracing now initializes inside the Tokio runtime instead of panicking when tracing is enabled.
• -Docker image build issues and clippy warnings introduced during observability bundle work were resolved.

Added

• -Distributed quota policies under resilience.quota with burst and sustained windows, composite selectors, and explicit enforcement modes.
• -Redis-backed and in-memory quota counter backends, plus bounded local fallback for outage-style Redis failures.
• -Quota observability through metrics and a new quota block in GET /admin/runtime.

Changed

• -Legacy scoped rate limiting now evaluates through the quota pipeline contract while preserving existing config behavior.

Fixed

• -Every matching quota policy is now evaluated instead of only the first one, preventing silently dead policies.
• -Requests missing a required selector identity are denied explicitly rather than being accidentally admitted by a broader policy.

Security

• -Quota enforcement is fail-closed by default, and config validation rejects incoherent policy and backend combinations at startup.

Added

• -RS256 and ES256 join HS256 for local JWT validation, with static PEM or JWK keys and remote JWKS support.
• -JWKS cache lifecycle controls, startup readiness gating, algorithm policy, and multi-issuer or multi-audience validation options.
• -JWT and JWKS metrics plus runtime introspection for providers and key-source state.

Changed

• -JWT verification now runs through a canonical pipeline with stable rejection reasons instead of ad hoc failure paths.
• -Key selection is re-checked at verification time so incompatible key types never satisfy the wrong algorithm.

Fixed

• -JWKS cache entries in retained failure states are preserved for their TTL window instead of being dropped too early.
• -Tokens without a kid are accepted only when exactly one compatible verification key remains.

Added

• -Control API mTLS with disabled, optional, or required client-auth modes separate from the data-plane listener policy.
• -Viewer, operator, and admin roles for control API routes, with role-scoped bearer tokens and certificate identity extraction.
• -Structured audit events for admin authentication, authorization, runtime reads, reloads, previews, activations, rollbacks, restarts, and cert reloads.

Changed

• -Control API rejections now distinguish authentication from authorization failure, returning 403 for insufficient role and 401 for missing or invalid auth.
• -The control API now builds its own TLS server configuration and advertises only HTTP/1.1 over ALPN.

Security

• -Bearer-token matching is constant-time and unsafe admin-plane configuration combinations are rejected at startup.

Added

• -POST /admin/runtime/validate, /preview, and /activate now plan and commit config changes as explicit staged operations.
• -Rollback by generation id and runtime generation history endpoints for auditability and safer recovery.
• -Normalized activation observability and rejection reasons across operator-facing runtime surfaces.

Changed

• -Operator-conflict responses now return structured 409 or 404 outcomes instead of collapsing into generic 500 responses.
• -POST /admin/runtime/reload defaults to the active runtime source and can explicitly activate an alternate config path.

Fixed

• -Reloading from an alternate config path now correctly makes that path the active runtime source.
• -Generation history records now reflect only the requested operation instead of writing synthetic preview entries.

Added

• -Canonical observability reasons and event fields across admission, overload, backend health, and runtime outcome recording.
• -A deterministic runtime lifecycle state machine driving reload, drain, and shutdown behavior.
• -Structured reload rejections and clearer operator-facing runtime policy vocabulary.

Fixed

• -Drain, shutdown, watchdog, DNS resolver carry-over, and client-rotation failures were hardened into explicit lifecycle behavior.
• -Stateful round-robin selection, failover on circuit-open retries, streaming guardrails, and bootstrap WebSocket upgrade handling were restored or stabilized.

Changed

• -Public crate surfaces were tightened and documentation was realigned to the post-refactor architecture.
• -Integration and unit tests were reorganized around behavioral contracts such as QUIC/bootstrap parity and metrics stability.

Added

• -Atomic runtime bundle hot reload via POST /admin/runtime/reload without process restart or connection drops.
• -Listener group reconciliation so added listeners start and removed listeners retire gracefully during reload.
• -Generation-aware background task tracking and live rebinding of metrics and control API endpoints on reload.

Fixed

• -Hot reload now rejects listener removals, bind-address changes, and startup-owned settings with explicit 409 Conflict responses.
• -Control API and certificate reload endpoints now target the live runtime bundle after a reload.

Changed

• -Large runtime and configuration modules were split into focused submodules, and integration tests were reorganized by subsystem.

Added

• -HTTP/1.1 upstream transport for http:// backends using pooled H1Client and H1Pool primitives.
• -Scheme-aware dispatch where https:// backends use HTTP/2 and http:// backends use HTTP/1.1.
• -Health checks and DNS refresh client rotation now work consistently for H1 backends as well.

Fixed

• -HTTP-only upstream configs no longer fail TLS trust-store validation unnecessarily.

Changed

• -The upstream transport layer was unified under UpstreamTransportPool with explicit backend transport kinds.

Fixed

• -Pool and transport errors now have distinct display text in logs.
• -Watchdog mutex poison is recovered and logged instead of silently disabling coordinator updates.
• -Validation failures are now exposed as structured errors and stale validation slots are cleared between reads.

Changed

• -OTLP tracing endpoint configuration is now driven by standard OTEL environment variables and logged at startup.
• -validate_config call sites were updated for the new Result-based validator contract.

Added

• -Live listener certificate reload, SNI-based certificate selection, per-upstream TLS policy overrides, and certificate telemetry.
• -Wildcard host routing, multi-listener support, CONNECT tunneling, response-trailer forwarding, and configurable forwarding-header policy.
• -Backend DNS refresh with shared resolver cache, runtime telemetry, and canonical normalized config validation before startup.

Fixed

• -Bootstrap streaming body-size enforcement, route-conflict validation, hostname checks, and backend failure classification were all hardened.
• -Insecure upstream TLS now always emits an explicit startup warning and H2 default client construction no longer panics.

Changed

• -Bootstrap forwarding, route precedence, backend health identity, DNS-driven client rotation, and TLS material loading were unified and clarified.

Added

• -upstream_tls.verify_certificates: false for trusted internal or development backends using self-signed certificates.

Fixed

• -Upstream TLS failures now log the full cause chain, making SAN, trust-root, and SNI problems immediately diagnosable.
• -The validator now warns instead of hard-rejecting configs that intentionally disable upstream certificate verification.
• -Debian packaging and systemd certificate ownership guidance were corrected so the impulse service user can read TLS files safely.

Changed

• -Debian assets moved under packaging/deb and installation and Docker docs were updated to match the packaging layout.

Added

• -HTTP/3 termination over QUIC with HTTP/2 backend connectivity and TLS 1.3 certificate handling.
• -Bootstrap HTTP/1.1 and HTTP/2 ingress, longest-match route selection, multiple load-balancing algorithms, and active health checking.
• -Structured logging, request metrics, bearer-token control API access, packaging, Docker support, and high-concurrency test coverage.