Release notes 0.1.158
27 October 2026: Fixes from the live read-back of 0.1.157 on 26 October: a certified runbook keeps its certification when an outside change explains why its fix did not hold, the AWS-published…
Release notes · Updated 2026-10-28 · Describes release 0.1.164
0.1.158 — 27 October 2026
Fixes from the live read-back of 0.1.157 on 26 October: a certified runbook keeps its certification when an outside change explains why its fix did not hold, the AWS-published runbooks reach every workspace with an AWS write connection, a scheduled release refused because the change class dropped says so in full, and two portal lines read in words. No new route, setting, permission, schema change or chart value; two new audit actions, route.deviation_explained and route.asr_seeded. Nothing to do for the upgrade itself (see the upgrade row).
- A runbook is not blamed for an outside change. Demote on deviation (
aiops_demote_on_deviation, on) took a certified runbook's certification away when its fix did not hold even where the recurrence had a recorded cause of its own: on the 26 October demo a Lambda runtime downgrade made from outside the platform reopened the finding the runbook had just fixed, and the runbook was demoted (route.demoted_deviation), which dropped the change class of its pending change and reset the approvals. Before demoting for a fix that did not hold, the platform now reads its own change ledger for a write on the same resource between the fix and the recurrence that its cloud audit harvest captured and classified as a principal other than the platform's. With one, the certification stays: the audit rowroute.deviation_explainedon the recurrence incident's Timeline (Runbook kept — an outside change explains the recurrence) names the fix and the outside change, and the route page's certification line reads a fix it made … did not hold — an outside change … on the same resource explains it; certification kept. Only the platform's own harvest counts: a recorded change with no principal, or one a webhook sender reported, keeps nothing pre-approved, and a write the cloud refused never does. The match reads the resource by its identifiers, so an EC2 instance the runbook names by ARN meets the bare instance id CloudTrail records, and the ledger is read for the rows naming the resource, newest first. A route an approver edited and certified after the run is neither demoted nor stamped: the revision that made the fix is gone. A run that fails its own validation is still demoted; the rule stays on. - A refused scheduled release says why. A release scheduled while the change was standard and refused at its time because the class had dropped (a demoted or withdrawn runbook resets the approvals) landed with a reason that did not say so. It now reads The change class dropped from standard to normal after this release was scheduled (…); the approvals it had no longer count. Review the change again, then release it or schedule it again — on the change row, in the audit row
change.schedule_refusedand in thechange_schedulenotification — and the whole of it fits the reason's 300 characters: the cause in the brackets is shortened, never the instruction. - The AWS-published runbooks reach every workspace. The five step runbooks captured from Automated Security Response on AWS (v4.1.0: EC2.8, EC2.13 and 14, EC2.19, S3.1, IAM.7) were added only beside the demo workspace's placeholder connection, so a workspace of your own never saw them. Within one scheduler tick (a minute) of an AWS write or read/write connection being enabled, they are added to the workspace, bound to its oldest such connection — disabled and not certified, listed as Not certified · disabled in the runbook catalog until a person points one at the connection they want and an approver certifies it; nothing enables them on its own. They are added once per workspace and AWS set version (audit
route.asr_seeded, AWS-published runbooks added): a runbook you delete or rename is not added again, an existing route of the same name is never touched, and a later version of the set adds only its new names. A workspace with no AWS write connection gets none. - Portal. The Approvals card of an automatically released change read L5.2 approved and released — system:auto; it now reads Released automatically — Platform (pre-approved), as the Class block and the Timeline already did. The Patch compliance card of the Scores page printed the stored reason of the report row, and rows written by an earlier release name a setting; the card now says in its own words that a patch-age rule (40 or another number of days) is optional and set by API, and never prints a stored reason. The audit vocabulary gains AWS-published runbooks added (
route.asr_seeded) and Runbook kept — an outside change explains the recurrence (route.deviation_explained).