Changelog

All notable, user-facing changes to Nexus are recorded here. The format follows Keep a Changelog, and Nexus uses Semantic Versioning. While Nexus is pre-1.0 (0.y.z), minor (y) bumps may be breaking and patch (z) bumps are non-breaking.

Release notes are generated from the Conventional Commits log per the Contributing Guide; feat: and fix: entries with a non-empty scope are grouped by scope. Each tagged release moves the entries below from Unreleased into a dated, versioned section.

• Documented the GitLab CI tiers, local reproduction commands, security gates, release-image signing, SBOM/provenance attestations, and consumer verification flow.
• Added a release-report step that uses an OpenAI-compatible LLM to turn verified release notes, image metadata, SBOMs, vulnerability scans, and provenance predicates into a human-readable GitLab Release report.

Initial release of Vortex Nexus: a self-hostable, multi-tenant AI gateway and LLM observability platform — OpenAI-compatible and native Anthropic edges in front of your providers, with cost tracking, classification policy, tamper-evident audit, and agent tracing on a fully open-source data plane (Postgres, ClickHouse, S3-compatible object storage, NATS, Valkey).

• OpenAI-compatible edge at /v1: chat completions (JSON + SSE), Responses, embeddings, image generations/edits/variations, models, files, and vector stores with nexus-native pgvector search.
• Native Anthropic Messages edge at /anthropic with count_tokens, streaming, tool use, extended-thinking preservation, and prompt-cache token pricing; Claude Code works via ANTHROPIC_BASE_URL.
• Provider/model routing grammar with caller-ordered fallbacks, retries, optional Redis-backed response cache, and per-key rate limits.
• BYOK-first attempt routing with opt-in escrow-backed pass-through billing (NEXUS_GATEWAY_PTB) and workspace/org/project spend caps.

• Workspaces → organizations → projects with manager/auditor/user RBAC, invitations, registration codes, and deployment-wide OIDC.
• API keys, KMS-wrapped BYOK provider keys, operator platform keys, Stripe-backed wallet top-ups, and a live model registry with per-provider sync and price bands.

• Request/session analytics in ClickHouse with usage rollups, HQL, feedback, and tenant exporters; OTLP agentic trace ingest under project-scoped keys with a console trace inspector.
• Per-tenant Merkle-chained audit events with signed batch roots, WORM archive anchoring, inclusion proofs, and the nexus-audit-verify CLI.
• Two-tier telemetry separation keeping tenant data out of operator OTLP, enforced by cardinality guards and collector processors.

• Next.js console: onboarding, key management, storage, requests, sessions, traces, usage dashboard, limits, billing, and audit viewer.
• nexus CLI for operator bootstrap, credentials, registry, and ops.
• Compose dev stack with hot reload, Grafana LGTM stack, Helm chart, just recipes, and SDK certification suites for OpenAI and Anthropic.

• ADR-tracked architecture decisions, STRIDE threat model, dependency license allowlist with cargo-deny/node enforcement, doc-lint in CI, DCO, CODEOWNERS security review gates, and a bounty program.
• Public changelog, security policy (SECURITY.md), contributor governance templates (issue/MR templates, CODEOWNERS), and a published compatibility matrix.