AxonFlow v11.3.0 Release Notes
v11.3.0 adds the platform foundations for Hosted Starter and governed payment and risk case resolution. The new commercial controls are disabled by default. Installing this release does not activate a paid cohort or authorize a financial action.
v11.3.1 supersedes this release with production rollout corrections. New deployments should use v11.3.1.
Hosted Starter foundation
- Registration, tenant-bound Checkout, signed Stripe webhooks, subscription lifecycle, and billing status are available behind explicit launch controls.
- Person-authenticated Customer Portal sessions are separate from service credentials. Owners, members, and reviewers receive distinct authority, and a requester cannot approve their own proposed action.
- Hosted configuration defaults to gate off, cohort zero, empty acceptance markers, empty workflow capabilities, and zero paid allowances.
Payment and risk workflows
Enterprise gains durable payment exception and support refund case storage with tenant ownership, action binding, idempotency, retention, monthly case budgets, and burst limits. FinCrime, payment exception, and support refund are independently entitled modules.
The workflows can reconcile evidence, propose a disposition, route a bound action for separate review, and record a non-executing result. A changed case, evidence set, amount, beneficiary, policy version, or action identity invalidates pending approval. Shared Hosted adapters do not move money or write to customer systems.
See Hosted Starter Portal and Outcome Workflows for the bounded hosted journey and Fraud and Risk Add-on Enablement for customer-managed FinCrime setup.
Security and isolation
- Migrations 190 through 196 and core migration 191 add Hosted person, session, billing, workflow, and service-credential storage with forced row-level security.
- Browser mutations enforce Origin and Referer checks. Portal proxies rebuild identity from the authenticated session and bind internal requests to method, path, organization, tenant, person, capability, body digest, and timestamp.
- Hosted service credentials are stored as one-way hashes, returned only at creation or rotation, and revoked within the tenant boundary.
- Reverse-proxy forwarding headers are rebuilt from the observed connection before internal authority is attached.
Operations
Deploy the platform with all new paid controls disabled. Verify migrations, forced-RLS census, route presence, backup and rollback posture, old and current client compatibility, and exact-image health before publishing client changes. Enabling a paid cohort is a separate launch decision.
Client versions
These are the client versions included in the completed v11.3 release train:
| Client | Version | Notes |
|---|---|---|
| Python, TypeScript, Go, and Java SDKs | 9.5.0 | No SDK release required. |
| Rust SDK (preview) | 0.12.0 | No SDK release required. |
| OpenClaw plugin | 2.10.0 | Adds authenticated Hosted Starter Checkout handling. |
| Claude Code plugin | 1.13.0 | No plugin release required. |
| Cursor plugin | 1.9.0 | No plugin release required. |
| Codex plugin | 1.9.0 | No plugin release required. |
| Claude Desktop proxy | 0.4.1 | Published and byte-verified in this train. |
| n8n node | 1.2.1 | No integration release required. |
| Google ADK plugin | 1.4.0 | Published and byte-verified in this train. |
| LiteLLM integration | 1.1.0 | No integration release required. |
Upgrade and rollback
Use the v11.3.0 installer bundle only with its matching image set. Preserve the previous image digests, database snapshot, license, and configuration as one rollback unit. Do not carry v11.3-only Hosted parameters into an older stack.
For a new deployment or an upgrade after 28 October 2026, use v11.3.1 and its matching installer bundle instead.
