---
title: Changelog
path: changelog
status: published
---

# Changelog

This is the user-facing history of what shipped in each ScaiLog release, drawn
from the phased delivery plan. Entries describe the capabilities you can rely on,
newest first. ScaiLog is licensed under Apache-2.0.

## Phase 2

Phase 2 broadens the SDK languages and adds the point-and-click and identity
surfaces on top of the Phase 1 core. Everything here is additive — the CLI and
built-in API keys from Phase 1 remain the primary, always-available path.

- **TypeScript and Go SDKs (plus .NET).** Wire-identical siblings of the Python
  reference SDK — same `pi()` markers, mandatory validated `call_site_id`,
  subject-required-for-PI, reserved-name rejection, ULIDs, and socket-NDJSON with
  stderr fallback. A log emitted from any language encrypts at ingest and decrypts
  back through DSAR identically.
- **Admin panel.** A thin SolidJS + Tailwind + DaisyUI single-page app over the
  server's `/v1` API: dashboard, log search (with explain and single-field
  decrypt), live tail over SSE, sites, subjects (DSAR/erase), policies, keys, and
  audit. The CLI remains the primary interface; the panel is the complement. It
  carries no ScaiLog runtime dependency.
- **OIDC / SSO login.** An optional identity plugin: the CLI logs in via the
  OAuth 2.0 device flow (`scailog login`), and the admin panel offers "Sign in
  with SSO" (Authorization Code + PKCE). The server validates the ID token and
  maps the `scailog_role` claim to a role. API keys stay the base mechanism and
  the system runs fully without OIDC.
- **`scailog-ci` full validation and manifest push.** The zero-dependency
  build-time validator checks call sites (constant, unique, well-formed ids; no
  message interpolation; `pi()` with a subject) and can push a call-site manifest
  to the server so drift shows up in `scailog sites --diff`.
- **Audit-guided targeted redaction.** `scailog audit redact` scrubs named
  plaintext fields that an audit flagged as untagged PI to `[AUDIT_REDACTED]`
  across a call site — an irreversible, `dpo`-only fix for PI that escaped
  tagging.
- **Signed report-key rotation.** The report-signing key becomes a rotating
  keyring (active plus retired keys); every DSAR report and erasure receipt embeds
  its signing key's public key and `key_id`, so documents stay verifiable after a
  rotation, and retired keys stay published at `GET /v1/report-keys`.
- **Prometheus `/metrics`.** The counters that must never be lost — panic drops,
  dead-letters, stderr fallbacks — are exposed as a Prometheus-format `/metrics`
  endpoint (and on `/v1/status`), so observability of the logger is
  metrics-shaped, avoiding a log-about-logging cycle.

## Phase 1 — initial release

The foundational release: the full GDPR-native logging path end to end, from SDK
emit through encryption, storage, query, DSAR, and cryptographic erasure. Erasure
by key-destruction ships here — it is the point of the product, not a later
hardening step.

- **Python SDK.** The reference emit library: mandatory `call_site_id`,
  field-level `pi()` markers, automatic context propagation, and socket-NDJSON
  emit with a non-silent, PI-redacting stderr fallback. The base install is pure
  stdlib with zero third-party dependencies.
- **Per-host agent.** `scailog-agent` terminates the local socket, encrypts PI
  immediately with per-subject keys, caches to a local SQLite file, and ships
  zstd-NDJSON batches to the server with idempotency, backoff, resume-after-restart,
  and per-entry dead-lettering. Panic mode refuses to cache plaintext PI when the
  server is unreachable.
- **Central server.** A single FastAPI service that ingests SLWP batches,
  validates entries, applies the policy engine, encrypts any PI not already
  encrypted by the agent, and writes to `scailog.db`. Hosts the built-in key
  manager and the separate `keymap.db`.
- **Policy engine.** Declarative YAML with most-specific resolution and
  versioning; four actions — `encrypt`, `redact`, `drop`, `keep` — applied per PI
  type, service, and environment.
- **Cryptographic erasure and DSAR.** Per-subject DEKs under a tenant KEK under
  the root key; erasure destroys the subject's key (crypto-shredding), leaving a
  tombstone and a signed erasure receipt. DSAR produces a signed subject report
  with decrypted PI.
- **Operator CLI.** `scailog` with `query`, `tail`, `sites`, `explain`, `dsar`,
  `erase`, `keys`, and `policy` commands.
- **Built-in API-key authentication.** Roles and capabilities, a
  minted-once bootstrap key, tenant/service scoping, expiry, rate limits, and IP
  allowlists — no external auth service required.
- **Retention sweeper.** Background enforcement of retention windows, including
  the deliberately short backup retention on `keymap.db`.
- **Standalone single-binary mode.** `scailog-server --standalone` embeds the
  agent role — one process, one directory of SQLite files — as a first-class
  supported deployment.
- **SLWP test-vector suite.** Normative Annex A crypto and wire-format vectors,
  re-checked by every SDK so the wire format cannot drift across languages.