Release: v1.0.0-beta-1 — Boundary enters beta

Authentication (boundary-user): the JWT algorithm is now pinned and startup fails fast on a weak secret — a JWT_SECRET of at least 32 characters is required, with a separate CSRF secret. MFA TOTP secrets are encrypted at rest and backup codes are hashed. Sessions rotate on password and role change, defeating fixation and stale-privilege reuse.

Access control: an IDOR on the user API routes (/users, /users/:id) is closed — a caller can no longer read or modify another user by id. User-management web routes are mounted behind authz guards, and the web user-detail page is admin-only.

Error hygiene (boundary-platform): 5xx responses no longer leak exception internals, and the admin error flash no longer echoes raw exception messages. Security response headers and session-cookie attributes are hardened, backed by a dedicated authz negative-path suite (RBAC / IDOR / cross-tenant) plus brute-force lockout and session-fixation coverage.

Jobs (boundary-jobs): the Redis dequeue is now reliable — jobs are no longer lost when a worker crashes mid-dequeue.

Docs site: patched a js-yaml DoS advisory (GHSA-h67p-54hq-rp68) and a brace-expansion advisory.

A Prometheus metrics adapter with a GET /metrics scrape endpoint.

A backend-agnostic tracing port (ITracer plus the with-span macro) with no-op and logging adapters.

An OpenTelemetry OTLP exporter for both traces and metrics, with automatic per-request HTTP spans and per-job worker spans. One vendor-neutral OTLP/HTTP exporter feeds any OTel backend — SigNoz, Grafana Tempo, Jaeger, or Datadog-via-OTel.

boundary-storage: a Google Cloud Storage adapter with V4 signed URLs, a :boundary/storage Integrant key dispatching :local / :s3 / :gcs, and real HMAC-signed, expiring URLs for the local adapter.

boundary-email: an in-memory email queue with bounded retry, :boundary/email and :boundary/email-queue Integrant keys, and user welcome mail routed through the email lib.

boundary-jobs: a DB-backed job queue adapter — durable background jobs without Redis — with transactional outbox enqueue.

Malli validators compiled once — validating with a raw schema re-parses it on every call (measured 8.6–9.9× overhead). All 121 static-schema call sites across 43 files now use validators compiled at namespace load; schema-as-argument callers get memoized compilation.

Logger dispatch — reflective logger interop on every request enter/leave replaced with protocol calls (~90× per call).

DB result conversion — snake→kebab key conversion moved into the next.jdbc builder-fn (converted once per result set, not per row); admin entity/table metadata cached in the long-lived schema repository, eliminating 2×N information_schema queries per page.

i18n — resolve-markers now shares structure and returns original nodes when nothing changed (82.4µs → 25.0µs on a 50-row table).

N+1 writes batched in boundary-audience and boundary-user — a 50k-user membership save drops from ~100k statements to ~102.

CSRF, correlation ids, JWT secret resolution, and the jobs heartbeat all took targeted fast-path fixes.

FC/IS core purity: definition registries and process guards moved out of core/ into the shell — core/ may no longer throw or hold mutable state, now enforced by check:fcis.

Dependency cycles dissolved: the platform↔user cycle broken via app-layer wiring; shared Hiccup UI extracted into a new boundary-shared-ui lib (dissolving admin↔user); tenant HTTP middleware relocated out of platform; parallel search stacks merged into libs/search.

Honesty: 15 previously-undeclared deps declared; dead protocols and helpers removed; deploy publish order derived from a topological sort of the dependency graph.