Changelog

Revenue protection: plan gating, API key CRUD with rotation, license verification for self-hosted

Frontend plan gates with upgrade prompts and sidebar badges

33 bug fixes from full system security audit — SQL injection, race conditions, parameter validation

FORCE ROW LEVEL SECURITY on all multi-tenant tables

User-scoped kill switch — proxy checks 4 Redis keys (global, department, project, user)

SLA escalation engine: multi-step policies with Slack, email, Teams, and auto-kill switch

Require-approval policy action enforced at proxy with Redis gateway

Agent monitor chain trace with GROUP BY trace_id for real span steps

Shadow AI detection — 3 methods: unapproved models, spend mismatch, anomaly detection

Agent fleet monitor with per-agent budgets, performance scoring, and scoped kill switch

Per-agent rate limiting at proxy level (sliding window)

Kafka handlers support multiple handlers per topic

Multi-cloud deployment: Helm chart, Docker Compose, Terraform modules (VPC, EKS, RDS, ElastiCache, S3)

Air-gapped deployment support with MinIO for S3-compatible storage

Multi-region data sovereignty with configurable routing

CI/CD pipeline with staging, prod deploy, k6 load testing, and Cargo cache

Prompt registry & versioning — slug-based templates, status transitions, usage analytics

Proxy template resolution via X-Spendpol-Template header (Step 6.05)

ClickHouse prompt_usage_daily materialized view for analytics

Redis sync for prompt templates with 300s TTL

Integration ecosystem: Webhooks, Slack, Jira, Microsoft Teams, Linear, Stripe, OIDC SSO

CI/CD policy enforcement with GitHub Action and CLI script

LLM framework SDKs: SpendpolOpenAI (TypeScript), SpendpolCallbackHandler (Python/LangChain)

Alert engine integration with Slack, Teams, and Linear for auto-ticket creation

FinOps chargeback engine — 3 allocation methods, invoice reconciliation, multi-currency FX

Cost forecasting with weighted linear regression and 95% confidence interval

Budget risk analysis with 4-tier severity (safe/warning/critical/exceeded)

What-if simulations for model replacement, usage reduction, and provider switching

Semantic cache — SHA-256 keyed, per-org isolation, configurable TTL, 15%+ savings

Intelligent model routing — cost optimization, failover, department routing

Cross-provider format conversion (OpenAI ↔ Anthropic)

Proxy response headers: X-Spendpol-Cache, X-Spendpol-Routed, X-Spendpol-Requested-Model

Initial release — Rust proxy with 18-step lifecycle, <30ms overhead

Real-time cost tracking, budget enforcement, policy engine, PII guard

30-page Next.js dashboard with dark theme

TypeScript and Python SDKs

PostgreSQL with RLS, Redis, ClickHouse, Redpanda (Kafka), OpenTelemetry