Release Notes

Built in two rounds and tested against real hardware throughout, not just written and assumed to work — a real VM, a real disk, a real VPC, a real `aws` CLI call, a real HAProxy round-trip, and a real k3s cluster were each exercised end to end on a real QEMU/KVM host. 82+ automated tests pass (30 Rust, 52 Node.js). Real hardware testing caught and fixed 7 genuine bugs a code review alone would have missed, including a pre-existing camelCase/snake_case wire-format mismatch in the node scheduler's capacity comparison (fixed at the customer's own request) and an SSH protocol ordering bug that silently truncated longer guest responses. Explicitly not built: GPU passthrough, full AWS coverage (S3/IAM/autoscaling), HTTP-aware load balancing, and TPM-backed identity or real SEV/TDX execution — each deferred for a stated, concrete reason, not silently skipped.

Post-quantum cryptography and Computer Backup reconciliation are complete and verified (127/127 SDK cryptography tests, including official ML-KEM test vectors and adversarial downgrade/tamper cases). Cleaner is built and tested (9/9 real filesystem tests on Windows); the live round trip through the compiled desktop app's native command bridge was attempted but not completed in this environment. Meet is functionally complete — 28 server-side tests passing, including every guest-access mode and server-enforced PQC-downgrade rejection — and was verified against a real running server in a real browser, a pass that found and fixed two genuine bugs (a pre-existing crash affecting any user, and a Meet-specific false error for anyone without a camera). What Meet still needs, honestly: a real two-person video call with real cameras, and a real phone running the mobile build — both need real hardware this engineering environment cannot provide. This stage stays IN_PROGRESS until that real-world test happens.

Built across 26 workstreams and deployed to the live website behind off-by-default feature flags, 3–5 October 2026. Honest ledger of 114 tracked deliverables: 49 finished and independently checked against the real database and, where there's a screen, a real browser; 35 built and tested in code but not yet proven against a real outside system; 27 partly built; 3 not built (mobile chat and push notifications — left for later by deliberate choice, not an oversight). The Sovereign Gateway, NTFS/Active-Directory folder-permission bridge, high-availability site replication, and Microsoft 365/Outlook integration are built and tested but not yet proven against a real company file server or a real Microsoft 365 tenant. The chat protocol's open-source library implementation has not had an independent security audit. The project's own final verification report states plainly that the SOW is not yet complete — this stage stays IN_PROGRESS until it is.

Live. 26 real tests passing across all three workstreams, including live runs against a real, disposable cloud sandbox created and destroyed for each test — not simulated. A real bug (an Evidence Graph collection-name mismatch) was found and fixed by the tests before shipping. Not built: read replicas / failover for the managed database (not yet verified through a real incident), and REGEX-type data-quality rules (the reference SQL connector has no portable REGEXP).

In progress. Done: main dApp routes, bridge, payments, S3 layer against the AWS CLI and rclone, contract suite, dependency audit. Still to do: Azure, Google Cloud Storage and Terraform against Inaya storage with their real tools; mobile, desktop and Inaya Drive on real devices (needs hardware); concurrency and failure injection; smart-contract static analysis; performance; CI review; and a complete re-run of the 179 test files. Open risks recorded: wallet-address metadata reads are unauthenticated by design, card-customer identity is the payer's email, the main dApp is on a Next.js version whose fix needs a major upgrade, and deleting an object does not yet unpin its provider copy. Provider plan limits (Pinata blocked, Filebase at its 500-pin free limit) need the owner's action.

Verified against the real database (flow, unit and security suites, including organization and department isolation, webhook signatures and replay, and hostile files). NOT verified against real outside accounts: live bank feeds (no provider is registered; import statements instead), a live email provider, a real WhatsApp Business account (tested against a stand-in for Meta), and OCR of images and scanned PDFs (no local OCR engine; depends on the AI model and is never auto-processed). Inaya has no general ledger and none was invented; no savings figures are estimated. Excel and PDF report exports are not offered.

Verified against a REAL Microsoft Entra tenant: the Graph directory pull, and the SCIM connection test, joiner and leaver as sent by Entra's own provisioning service, including a leaver with six verified revocation steps. Active Directory is now ALSO verified for real: a genuine Windows Server domain controller was stood up, a real test user (with mail/department/title) was created in it, and the new sync agent pulled her and pushed her through the unmodified engine end to end — PROCESSED, with real identity/membership records to show for it. Three real bugs were found and fixed along the way (tenantId derivation, AD's GeneralizedTime timestamp format, an async client-shutdown race that crashed the agent on Windows). NOT verified: group-membership push from Entra, Rewst (a paid product not available to test; Inaya works with any automation platform through its open API), Okta, and HR/PSA/RMM tools, which are built as generic adapters only. Documentation labels each integration VERIFIED, PARTIAL, UNVERIFIED, UNSUPPORTED or FUTURE.

Verified against the real database; Help & Support verified by seven automated tests and a live production check of the endpoints. NOT yet verified against real providers: reply-by-email through the inbound email provider (built, setup pending), company single sign-on, and the malware scanner. To make Help & Support fully visible to dApp visitors, the Inaya Network organization's portal must be switched on in Customer Support settings.

Verified against the real database. Slack sending and Gmail delivery were each verified live from a published production workflow on 2026-09-26. A real external helpdesk product is NOT verified (tested against a local stand-in only).

Verified against the real database, including a storage-outage simulation and provider fallback. The Pinata plan limit blocked storage during testing; storage now falls back across configured providers. Live PDF generation, including Arabic and Urdu, was confirmed on the production site on 2026-09-27 (a bundler defect that broke every PDF export on Vercel was found by this live check and fixed the same day; see SQA-026 in the defect registry). A secure link is bearer access — the recipient's email is recorded, not verified, except in Data Room delivery. Country-specific e-invoicing formats are not built. Follow-up under investigation: one document-number ledger assertion in the lifecycle suite after an invoice cancel.

Live-verified: 23/23 adversarial tests, and a real HTTP round trip against the running server in which a real injection attempt on the business assistant was blocked while normal chat was unaffected. Known boundaries: the voice assistant (speech goes browser to Gemini Live directly) is not gateway-covered; the documentation assistant streams with input-side checks only; routes that have no organization log without an organization audit chain. No independent security certification is claimed.

Implemented and tested end to end on ONE documented profile: a Linux VM appliance (Ubuntu 26.04, Samba, NFSv4.2, mdadm, Btrfs) with real disk failure, crash recovery and real Windows and Linux clients. NOT validated on physical hardware (SMART, temperature and UPS are reported UNKNOWN on virtual disks) — the largest remaining gap and the next step before selling hardware. NAS-to-NAS replication was tested on one host only; Active Directory/LDAP login, iSCSI, a local S3 gateway and Kubernetes CSI are not implemented; macOS is untested.

Live-verified: 11 automated tests for the connector/metadata/gateway layer, 7 automated JDBC integration tests, 19 automated ODBC direct-load tests, and 7 automated RMS/OpenVMS tests against a live OpenVMS instance. Real bugs found and fixed this pass, each confirmed against the real system: getting OpenVMS itself to boot under a hypervisor took five separate genuine firmware/controller/boot-order fixes; the RMS connector's SSH dependency broke Next.js's production bundling for every route that touches the connector registry; and getting the ODBC driver through the real Windows Driver Manager for the first time surfaced five more real bugs (a PowerShell script parameter colliding with a built-in variable, two connection-attribute handlers that hard-errored instead of no-opping, a DSN-resolution gap, and a missing mandatory ODBC Core function whose absence crashed the Driver Manager itself). ODBC registration and a real Driver-Manager-mediated connection are now proven; query execution through that same path still crashes, isolated via the Windows Event Log to a fault inside Microsoft's own odbc32.dll, not this driver — documented honestly as open. Not built: Adabas, VSAM and IMS connectors (Adabas's test environment — a real Docker container — is up and healthy, but the connector code isn't written; VSAM/IMS require a genuine z/OS environment, a much larger undertaking), write-back, and federated cross-source joins. See docs/mainframe-legacy-data-access-report.md for the full breakdown.

Live-verified: 10 automated tests (frontmatter/slug/status validation, cross-reference integrity, and an OpenAPI-spec-matches-reference-data regression guard), a clean production build, and real browser verification including a genuine mobile-layout bug found and fixed (a search button overlapping its own placeholder text at narrow widths). Shipping this also surfaced and fixed an unrelated, pre-existing production issue: Vercel deployments had been silently failing for roughly 20 hours because a sibling local package's own dependencies were never installed in that environment — fixed with a postinstall hook, verified by simulating a clean install before shipping. Not built: a Tutorials/Solutions/FAQ-as-a-system content type, API/SDK/CLI drift checking against the live route files, a full CI validation/accessibility/SEO suite, an admin/governance interface, and an API playground — the SOW's own 15-phase plan spans well beyond this pass, and this stage covers Phases 0–3 plus slices of 4–7.

Live-verified: 35 automated tests across the storage resource, snapshot, backup policy, and Digital Twin integration layers, all passing against the real database and real S3-compatible storage write path, plus the Terraform provider's full create/read/update/delete cycle run against a real local Inaya deployment with real MongoDB-backed state — not a dry run. That testing caught and fixed a real bug (the provider's computed health/created_at fields were briefly blank immediately after creation, before the next refresh). Not built: fast/accelerated restore (no backend primitive exists to make one honestly faster than a normal restore), real physical block-volume attach or real multi-client NFS mounting (structurally impossible without a compute layer Inaya doesn't have), and live interop validation against real IBM Cloud Object Storage (blocked on IBM's own account sign-up, not on anything left to build). The Terraform provider is not yet published to the Terraform Registry — it runs from a local build today.

Live-verified: Data Room Templates covered by 8 automated tests (zero regressions to the pre-existing external-data-room suite); Cloud Backup Scheduler by 12 tests, including a genuine end-to-end run through the real migration engine and real storage write path via Node's module-mocking (only the external cloud source is substituted); What-If Studio extends the existing, already-tested Digital Twin test suite with 2 additional tests. DirectSync is covered by 7 unit tests plus 1 real, non-mocked end-to-end test — a real folder watched, real files uploaded, real duplicate-safety, real rename, and real delete-preserves-remote-copy behavior, all run on real Windows hardware. DirectSync's Windows support is real and tested; Linux is built on the same already-proven cross-platform components (the identical S3 client already verified working on Linux elsewhere in the platform) but has not yet been run on a real Linux machine, so it is stated as not yet verified rather than claimed. A real bug — a rename only updating local bookkeeping without actually relocating the object in storage — was found by the end-to-end test and fixed before this stage was marked live.

Live-verified: 47 tests for the Evidence Graph layer and 9 tests for the Digital Twin layer, all passing against the real database, with zero regressions to any pre-existing test suite. The single strongest test in both layers is the same: run every simulation/scenario type, snapshot every record it reads before and after, and assert byte-for-byte equality — proving a simulation can never silently become a real action. Cross-organization Digital Twins (e.g., one company privately checking another's fulfilment capacity without seeing their internal data) were researched — zero-knowledge proofs, secure multiparty computation, and trusted-execution options were all evaluated — and deliberately deferred rather than built, since no validated customer need for it exists yet and building that cryptography speculatively isn't justified. Not yet built: a graph-visualization UI, versioned Twin snapshots for reproducibility, and natural-language scenario creation — the underlying model and API are complete and tested; the UI layer that would sit on top of them is a later pass.

Live-verified end-to-end: real SigV4/GOOG4/Shared-Key signature verification, a real signed-URL adversarial test suite (including waiting for genuine wall-clock expiration, not a simulated clock), real Terraform init/apply/plan/destroy and rclone upload/sync/download runs against the live endpoint, and Inaya Drive mounted for real on both a Windows machine and a Linux kernel (WSL2) with a full helper-process kill-and-restart persistence proof. macOS Drive support is written but not yet compiled or tested on real Mac hardware — explicitly not claimed until it is. The September 2026 storage feature expansion (tags, checksum, inventory, batch operations, analytics, policy analyzer) is covered by 9 additional automated tests, with zero regressions to the 57 pre-existing storage tests — a genuine, previously-unnoticed misconfiguration in the Pinata backup-provider credential was also found and fixed along the way. No official AWS/Microsoft/Google partnership, certification, or full protocol parity is claimed anywhere; only what's been directly tested.

Live-verified: the Government OS vertical option renders correctly in the org-creation flow, and every new API route is statically confirmed to lock to the government vertical. 51 new automated tests cover the two load-bearing properties (citizen-record access requires an actual assignment; a published policy knowledge base entry can never be mutated in place) plus case-workflow transition legality, dashboard honesty (unknown is never shown as passing), and AI tool need-to-know enforcement. Not yet built: mobile screens (Government OS has zero mobile presence today, same gap as Financial/Private Capital/Regulated Enterprise OS), a real pilot-agency onboarding, and any government-specific procurement rule beyond an explicitly informational, non-binding competitive-bid threshold flag. No government certification, accreditation, FedRAMP authorization, or jurisdiction-specific compliance claim exists or is claimed — that requires separate authorities entirely outside this codebase.

Live-verified end-to-end against the running app across every phase: control creation and activation, a failing test auto-opening a finding and walking its full state machine to closed, the dashboard's unknown/failing/passing distinction, the full policy lifecycle including the immutability guard and amend-creates-a-new-version behavior, an examiner magic-link's issue/exchange/one-time-use cycle, entity-scoped fund/deal visibility, and the board-report/export-package immutability guards. Not yet built: mobile screens for these verticals (Financial Services OS/Private Capital OS/Regulated Enterprise OS have zero mobile presence today — web only), and real third-party integrations (every adapter is a documented, honest not-configured stub). No compliance certification of any kind exists or is claimed.

Every domain module for both verticals now has a real, working screen in Business Workspace — not just Patients and Matters — live-verified end-to-end against the running app, including the trust ledger's server-side overdraft rejection. Mobile now has real screens for both verticals too (Health OS, Legal OS, and their patient/matter detail screens), built against the exact same vertical-locked API routes as web; these are written and syntax-verified but not yet exercised on a live device/simulator, which is the one thing still holding this at IN_PROGRESS rather than LIVE. FHIR/HL7/e-filing/e-signature/SSO and every other third-party integration are documented adapter interfaces with an honest not-configured stub, not live integrations. No HIPAA/ABA/eDiscovery compliance certification exists or is claimed.

Real and shipped across 9 domains, covered by 19 automated tests including 11 adversarial security scenarios (forged approval, cross-tenant access, replay, expired-proposal execution, prompt injection, and more — all fail safely). Explicitly not yet covered: AI-driven record creation (a new task/contact/etc.), task reassignment, transaction categorization, and drafting/sending customer communications — none of these exist anywhere in the app yet, gated or not, so there's nothing yet to guard. See docs/ai-controlled-actions.md for the full phase-by-phase breakdown.

Real and shipped: KPI cards, period-over-period comparison, trend charts, and business alerts all compute from the same permission-scoped data every other Business Workspace module already reads — no separate, weaker-scoped path. The AI Business Assistant answers KPI/trend/alert questions directly via a dedicated get_business_insights tool. The Business Brief (new 2026-09-01) is a periodic recap on the same real data — deterministic highlight bullets plus a best-effort AI narrative paragraph on top, available as its own Workspace view and conversationally via get_business_brief. See BUSINESS_OPERATIONS_INSIGHTS.md for what's covered and what's explicitly not yet (no custom date-range picker, no trend charts on mobile yet).

Both modules are real and shipped: invoices with a cron-driven overdue status, expense approval workflows, payment recording/approval, and CSV financial reporting; employee lifecycle management, computed leave balances, leave approval, and Department Manager assignment. A testnet demonstration/validation layer, not regulated banking, tax filing, or payroll processing — every Finance/HR screen carries a visible "Testnet / Beta" badge. See BUSINESS_OPERATIONS_FINANCE.md and _HR.md for what's covered and what's explicitly not yet (e.g. no PDF invoice generation, no multi-currency conversion).

All four modules are real and shipped: task status workflows, a unified Lead/Customer CRM with a sales pipeline, purchase requests/orders with a real approval chain, and inventory with real stock movements — including purchase orders that actually move inventory when received. Every record is department-scoped and queryable by the AI assistant. See BUSINESS_OPERATIONS_TASKS.md, _CRM.md, _PROCUREMENT.md, and _INVENTORY.md for what's covered and what's explicitly not yet (e.g. warehouse-to-warehouse transfer UI, PO line-item editing after creation).

Same Business Workspace, same permissions and encryption, running in its own window instead of a browser tab. macOS is not available yet. October 2026: found and fixed a real bug where the desktop app's security allowlist never actually granted the website permission to call most of its native features (chat notifications, tray unread count, pop-out module windows, DirectSync, Inaya Drive mount) — every installed copy needed a new signed build to pick up the fix, since that allowlist is compiled into the app, not loaded from the website. Also rotated the auto-update signing key after the original key's password turned out to be unrecoverable, and fixed the updater checking the wrong app's release.

Live today in both the web and mobile Business Workspace, powered by the exact same permission-scoped tools on the backend. Read-only here — for the AI's ability to propose real changes (never execute them directly), see Stage 9.