0.4.1

Full Changelog: 0.4.0...0.4.1

0.4.0

Full Changelog: v0.3.0...0.4.0

v0.3.0

Release notes: 0.2.0 -> v0.3.0

2 PRs / 2 commits since 0.2.0 (released 2026-06-19).

Summary

• The internal/admin API can now be opened to a specific operator IP through deploy configuration, with no code change required. Previously this setting was never actually plumbed into the deploy pipeline, so the running service silently fell back to its built-in default — reachable only from localhost and the Docker network.
• Added a fail-safe so a misconfigured deploy secret can never accidentally expose the admin endpoints to the entire internet: a catch-all or empty allowlist is now rejected at startup rather than quietly opening everything.
• Made the IP-range config parser more forgiving — stray commas and blank entries (e.g. from an unset optional secret) no longer crash the service on startup.
• Merge-queue housekeeping: PRs landed through Graphite's merge queue now get auto-labeled as externally-merged, so their linked Linear issues close automatically instead of lingering open after the work has shipped.

Highlights

The headline change is wiring up the internal IP allowlist (#200) with a built-in fail-safe — approved operators can now reach the admin API via deploy config, while a fat-fingered secret can no longer accidentally leave those endpoints wide open.

Pull requests

• #200 feat: wire INTERNAL_IP_RANGES allowlist + harden IP whitelist parser — @JuaniRios
• #201 ci: auto-apply externally-merged label for Graphite MQ closes — @JuaniRios

Technical changelog

Security / Admin API access control

• #200 feat: Wires INTERNAL_IP_RANGES into the deploy pipeline — it was absent from .env.example, the envs: passlist, and the env: block, so the service always fell back to the compiled-in default (127.0.0.0/8,::1/128,172.16.0.0/12). .env.example now appends an ${INTERNAL_IP_RANGES_EXTRA} secret to the base ranges and deploy.yaml passes it through, so an external operator IP can be allowlisted without a code change and the value can never be empty or catch-all. Adds an InternalIpWhitelist newtype (src/auth/ip_whitelist.rs) that rejects empty / 0.0.0.0/0 / ::/0 at parse time, hardens IpWhitelist::from_str to trim/skip blank segments (trailing comma no longer fails startup), and suppresses the misleading "all IPs allowed" warning before rejection. config/prod — new INTERNAL_IP_RANGES_EXTRA deploy secret + .env.example change. Closes RAI-1133. (Known limitation: split-CIDR catch-all not detected — tracked in RAI-1134.) — @JuaniRios

Infra / CI

• #201 ci: Adds .github/workflows/externally-merged.yaml so PRs closed by Graphite's merge queue get the externally-merged label, letting Linear treat the close as a merge and auto-close the linked issue. Two jobs: a fast-path label job on pull_request: closed (verifies Graphite's "Merged by the merge queue" marker and creates the label if missing) and a push: main push-backstop that re-scans pushed commits via the compare API (250-commit cap, fails loudly past it) to catch closed-PR events GitHub drops during tight MQ bursts. Marker-gated and idempotent. CI-only workflow, no application logic; ported from the st0x.liquidity repo (trunk main, ubuntu-latest runners). RAI-1136. — @JuaniRios

0.2.0

Full Changelog: rollback...0.2.0

pin to rollback bad deployment to

What's Changed

• spec out es/cqrs architecture by @0xgleb in #2
• Create a ROADMAP by @0xgleb in #4
• Setup the project by @0xgleb in #37
• Setup Rocket.rs web framework skeleton + SQLite with sqlx by @0xgleb in #38
• Set up CI by @0xgleb in #39
• Implement EventRepository trait for SQLite by @0xgleb in #40
• Implement ViewRepository trait by @0xgleb in #41
• Feat/connect account endpoint stub by @0xgleb in #42
• Feat/account linking by @0xgleb in #43
• create GET /tokenized-assets endpoint stub by @0xgleb in #44
• Implement tokenized asset registry by @0xgleb in #45
• POST /inkind/issuance endpoint stub by @0xgleb in #46
• Initialize mint by @0xgleb in #47
• POST /inkind/issuance/confirm endpoint stub by @0xgleb in #48
• Implement journal confirmation and rejection by @0xgleb in #49
• Implement BlockchainService and on-chain minting by @0xgleb in #50
• Implement redemption detection with WebSocket monitoring by @0xgleb in #54
• Implement Alpaca mint callback by @0xgleb in #51
• Add E2E test infrastructure and first mint flow test by @0xgleb in #53
• Implement Alpaca redemption workflow by @0xgleb in #55
• implement Alpaca journal polling for redemptions by @0xgleb in #56
• Integrate HyperDX telemetry by @0xgleb in #60
• Add ReceiptInventoryView for tracking ERC-1155 receipt lifecycle by @0xgleb in #59
• Implement token burning for redemption flow by @0xgleb in #61
• e2e redemption tests by @0xgleb in #58
• Split account linking and wallet whitelisting into separate steps by @0xgleb in #68
• fix /tokenized-assets response by @0xgleb in #69
• Add API authentication with API key, IP whitelisting, and rate limiting by @0xgleb in #63
• change the auth header to one alpaca prefers by @0xgleb in #71
• live testing fixes by @0xgleb in #73
• Setup continuous deployment by @0xgleb in #66
• fix account lifecycle by @0xgleb in #75
• Fix IP whitelisting and error messages by @0xgleb in #77
• fixes from live testing by @0xgleb in #79
• add admin endpoint for tokenized assets by @0xgleb in #92
• fix ip whitelisting deployment env var by @0xgleb in #94
• fix SFT vault address configuration by @0xgleb in #95
• Fix/alpaca redemption response by @0xgleb in #98
• fix tokenization requests list format by @0xgleb in #99
• Fix/alpaca redemption response by @0xgleb in #100
• fix receipt tracking by @0xgleb in #101
• fix race condition in e2e tests by @0xgleb in #103
• Migrate key signing to Fireblocks by @alastairong1 in #97
• provide chain id to signers by @0xgleb in #105
• Refactor Fireblocks from RAW signing to CONTRACT_CALL by @alastairong1 in #102
• multi-receipt burn and journaled mint recovery by @0xgleb in #104
• Improve logs and fix fireblocks ID by @0xgleb in #106
• Fix issuer request id type mismatch by @0xgleb in #109
• complete mints failed during tx submission upon receipt discovery by @0xgleb in #112
• feat: wallet un-whitelisting by @0xgleb in #116
• fix multi-vault redemption bug by @0xgleb in #117
• detect and reconcile external burns by @0xgleb in #122
• resolve fireblocks contract wallet via API per call by @0xgleb in #125
• fix: switch fireblocks-sdk to fork that treats Confirming as non-terminal by @0xgleb in #128
• fix: run recovery synchronously before serving by @JuaniRios in #133
• Receipt metadata encoding by @JuaniRios in #130
• Track transfer events by @JuaniRios in #131
• optimize event filtering by @JuaniRios in #136
• fix: poll for mock callbacks instead of asserting immediately by @JuaniRios in #139
• fix: prevent duplicate Alpaca mint callbacks from receipt monitor race by @JuaniRios in #140
• fix: checkpoint issuance backfills before serving by @findolor in #141
• feat: add reprocessing endpoint for stuck/failed aggregates by @JuaniRios in #142
• refactor: unify redemption recovery with Alpaca verification and Fireblocks burn detection by @JuaniRios in #143
• fix: MintView drops recovery events from MintingFailed state by @0xgleb in #127
• refactor: reclassify tracing log levels and add domain categories by @JuaniRios in #144
• feat: add tokenization_request_id and timestamp to /admin/stuck endpoint by @JuaniRios in #145
• feat: resilient mint recovery by @JuaniRios in #146
• fix: isolate WSS subscriptions, use HTTP for RPC calls, recovery timeout (RAI-416) by @JuaniRios in #147
• fix: rm sqlite-es crate in favor of event-sorcery repo by @0xgleb in #151
• feat: split submit/confirm for idempotent mint/burn recovery (RAI-374) by @JuaniRios in #149
• feat: add GET /admin/fireblocks/tx/ endpoint for transaction status lookup by @JuaniRios in #148
• feat: replace eth_subscribe with eth_getLogs polling (RAI-487) by @JuaniRios in #150
• fix: resolve clippy lints blocking CI by @JuaniRios in #152
• fix: remove deleted sqlite-es crate from Dockerfile by @JuaniRios in #153
• docs: add ops recovery guide for stuck mints and redemptions by @JuaniRios in #155
• fix: mint recovery sends callback in one command, enrich /admin/stuck by @JuaniRios in #154
• fix: replace event-sourced poll checkpoints with SQL table (RAI-617) by @JuaniRios in #156
• fix: use Alpaca callback redeem endpoint by @JuaniRios in #157
• feat: surface Fireblocks subStatus on /admin/stuck and /admin/fireblocks/tx (RAI-621) by @JuaniRios in #158
• fix: retry terminal failed Fireblocks mints by @JuaniRios in #159
• fix: stabilize deploy-blocking tests by @JuaniRios in #160
• feat: enrich stuck redemption tx metadata by @JuaniRios in #161
• fix: burn recovered redemptions immediately by @JuaniRios in #162
• fix: reserve submitted redempt...