AxonFlow v7.7.0 Release Notes

V1 launch release. First public release of the paid Pro tier and credential recovery for AxonFlow Community SaaS. Self-hosted deployments are unaffected; existing Self-Hosted licenses keep validating via the documented backward-compat path.

V1 customer-facing surfaces shipping together:

• Paid Pro tier ($9.99 one-time, 90 days). Stripe Checkout success mints an Ed25519-signed plugin license token, persists it on the tenant, and emails it to the buyer. The token paste activates Pro features immediately on every governed request through the plugin. Full Stripe refunds within the 14-day window auto-revoke the license.
• Free-tier credential recovery. A Community SaaS tenant who opted into recovery at sign-up time can self-recover a lost secret via emailed magic link. Capped at 3 active tenants per email; per-IP rate limit prevents enumeration probes.
• License Matrix. Six canonical aud claims describe every license token; per-context accept lists reject cross-quadrant misuse at the validator boundary.
• GDPR right-to-erasure. Two-step email-verified tenant deletion atomically scrubs registration, license, audit history, daily-usage counters, and per-tenant usage records. An immutable deletion log row survives the cascade for Article 30 compliance.

Companion plugin and SDK release. All four plugins (axonflow-claude-plugin, axonflow-cursor-plugin, axonflow-codex-plugin, axonflow-openclaw-plugin) advance to v1.2.0 / v2.2.0 with the new X-Axonflow-Client header and scope-aware license validation. All four stable SDKs (Go, Python, TypeScript, Java) advance to v7.1.0 with matching header injection. Existing v7.0.x SDK / v1.1.x plugin callers continue to work without the header — they receive a one-time upgrade hint.

No breaking platform changes for existing self-hosted Enterprise tenants. Existing license tokens validate cleanly via the missing-aud fallback documented in the License Matrix below.

What's new

Paid Pro v1 tier — $9.99 one-time

Pro tier extends the Community SaaS Free baseline (3-day audit retention, 200 events/day) to 30-day audit retention + 1,000 events/day for 90 days from purchase. After 90 days the tenant returns to Free; there's no recurring charge and no auto-renewal — re-purchase to continue. Full Stripe refunds within 14 days auto-revoke the license.

Full per-tier comparison + buy flow + per-plugin token install at Plugin Pro.

Stripe webhook handler: POST /api/v1/billing/stripe-webhook receives checkout.session.completed and charge.refunded events from Stripe Live or Test mode. Defenses:

• Stripe-Signature HMAC verification — only Stripe-signed events are processed
• IP allowlist — Stripe's published webhook CIDRs, with AXONFLOW_STRIPE_WEBHOOK_IP_ALLOWLIST env-override for staging
• Per-IP rate limit — default 60/min, AXONFLOW_STRIPE_WEBHOOK_RATE_PER_MIN env-override
• Idempotency over stripe_session_id — Stripe's at-least-once delivery is handled correctly; a retry returns the original token byte-identically, never a new one
• GET returns 405 — misconfigured webhook URLs in the Stripe Dashboard fail loudly instead of silently 200-ing on health probes

License token validation on every governed request: validateCommunitySaasAuth reads the X-License-Token header, validates the Ed25519 signature, checks the token's audience claim against the SaaS Plugin accept list, verifies the tenant binding matches the auth-resolved tenant, and looks up the active row in plugin_user_licenses. Free tier (no header) passes through unmodified; Pro / Premium tier promotes the request when both token and row are valid. Per-request DB lookup keeps revocation effective within ~60s of a chargeback or dispute.

Per-tenant daily quota now fires on plugin / SDK proxy routes too. The cap mirrors onto /api/v1/process, /api/v1/audit/*, /api/v1/mcp/evaluate-policies, and /api/v1/connectors — Free 200/day, Pro 1,000/day, Premium 5,000/day (reserved). The legacy COMMUNITY_SAAS_DAILY_LIMIT env var stays as a fallback for callers without a resolved tier.

Per-tenant audit retention — Free 3 days, Pro 30 days, Premium 90 days (reserved). Self-hosted deployments without the SaaS schema fall through cleanly via a relation does not exist guard.

Free-tier credential recovery

A Community SaaS tenant that registered with an email can recover their credentials themselves if they lose the secret. The flow is anti-enumeration by design — the platform always returns 202 to a recover request, regardless of whether the email is on file, and the magic link is single-use with a 15-minute window.

• POST /api/v1/recover — request a magic link. Body: {"email": "..."}. Response: 202 (always).
• POST /api/v1/recover/verify — consume a magic-link token and receive fresh credentials bound to the same email. Capped at 3 active tenants per email.
• GET /api/v1/recover/verify — HTML confirmation page (no state change) so email prefetchers don't burn the token.
• Email field on POST /api/v1/register — Community SaaS registrants can opt into recovery at sign-up time.

License Matrix — explicit aud per hosting-mode × scope

Six canonical audience values now describe the matrix:

aud value	Hosting mode	Scope	Use
axonflow.saas.plugin	SaaS	plugin	V1 Pro tier (Stripe checkout)
axonflow.saas.sdk	SaaS	sdk	future SaaS-SDK product
axonflow.saas.full	SaaS	full	future SaaS-full product
axonflow.self_hosted.plugin	Self-hosted	plugin	future Plugin In-VPC eval
axonflow.self_hosted.sdk	Self-hosted	sdk	future SDK product
axonflow.self_hosted.full	Self-hosted	full	existing Self-Hosted Enterprise

Each license-validation context (SaaS Plugin path, SaaS SDK path, self-hosted loader) ships an explicit accept list — cross-quadrant misuse (e.g. a SaaS Plugin Pro token pasted into AXONFLOW_LICENSE_KEY, or a self-hosted Enterprise license sent as X-License-Token) is rejected at the validator boundary with an explicit reason. Two helpers on ServiceLicensePayload derive the matrix coordinates from aud: HostingMode() and HasScope(scope).

Backward compat: existing tokens predating the rename have empty aud and validate via a documented fallback to axonflow.self_hosted.full — no production breakage on upgrade.

X-Axonflow-Client header — wire-level client identification

Every governed client (plugin or SDK) now sets one header on every request to the agent:

X-Axonflow-Client: <client-id>/<version>

Examples: openclaw/2.2.0, claude-code-plugin/1.2.0, cursor-plugin/1.2.0, codex-plugin/1.2.0, sdk-typescript/7.1.0, sdk-go/7.1.0.

The agent reads this header in validateCommunitySaasAuth, derives the request scope (plugin if matches a known plugin id, sdk if matches sdk-*, full otherwise), and validates the scope against the token's aud segment via HasScope(). Absent header defaults to full scope so existing v7.0.x SDK callers that haven't upgraded yet keep working — they receive a one-time upgrade hint per process.

GDPR right-to-erasure

• POST /api/v1/tenant/<id>/delete-request + POST /api/v1/tenant/<id>/delete-confirm — two-step email-verified tenant deletion. delete-request accepts the email-on-file and emails a single-use 1-hour confirmation token; delete-confirm consumes the token and atomically scrubs the tenant from registration, license, audit log, daily-usage, and usage-events tables. Stripe customer archive runs best-effort post-commit (DB-side erasure completes regardless of Stripe reachability). Per-IP (1/min) and per-tenant (1/hour) rate limits prevent spam. Tokens stored as HMAC-SHA256 (with optional AXONFLOW_TENANT_DELETE_TOKEN_PEPPER for at-rest hardening).

Verifier-only public-key posture (production-recommended)

AXONFLOW_PLUGIN_CLAIMED_PUBLIC_KEY — when set, the agent verifies plugin tokens without touching the signing seed; only the issuer service holds the seed. Recommended production posture so a runtime compromise of the agent cannot mint forged tokens. Backward-compatible: when unset, the agent derives the pubkey from AXONFLOW_PLUGIN_CLAIMED_SIGNING_KEY (single-process / dev posture).

New environment variables

Name	Purpose	Default
AXONFLOW_PLUGIN_CLAIMED_PUBLIC_KEY	Verifier-only Ed25519 pubkey (base64). When set, the agent doesn't need the signing seed.	unset (falls back to deriving from signing key)
AXONFLOW_STRIPE_WEBHOOK_IP_ALLOWLIST	Comma-separated CIDRs allowed to POST to the Stripe webhook.	Stripe's published webhook CIDRs
AXONFLOW_STRIPE_WEBHOOK_RATE_PER_MIN	Per-source-IP rate limit on the Stripe webhook.	60
AXONFLOW_BILLING_PRO_VALIDITY_DAYS	Override the 90-day default Pro license validity. Bad / non-positive values fall through to default.	90
AXONFLOW_BILLING_FROM_EMAIL	From-address on post-purchase license-delivery emails.	AxonFlow <[email protected]>
AXONFLOW_TENANT_DELETE_TOKEN_PEPPER	Optional at-rest hardening for the GDPR delete-confirmation token hash.	unset

Companion plugin releases

Plugin	Version	Install
OpenClaw (axonflow-openclaw-plugin)	v2.2.0	npm install @axonflow/openclaw@^2.2.0
Claude Code (axonflow-claude-plugin)	v1.2.0	Marketplace install via Claude Code
Cursor (axonflow-cursor-plugin)	v1.2.0	Cursor IDE local install
Codex (axonflow-codex-plugin)	v1.2.0	Codex marketplace install

All four plugins now send X-Axonflow-Client: <plugin-id>/<version> on every governed agent request and read X-License-Token from ${AXONFLOW_LICENSE_TOKEN} env var (universal across plugins) or a per-plugin persistent file. Full per-plugin install at Plugin Pro.

Companion SDK releases

SDK	Version	Install
Go	v7.1.0	go get github.com/getaxonflow/[email protected]
Python	v7.1.0	pip install 'axonflow>=7.1.0'
TypeScript	v7.1.0	npm install @axonflow/sdk@^7.1.0
Java	v7.1.0	<version>7.1.0</version> in pom.xml
Rust	v0.1.0 (preview, unchanged)	cargo add axonflow-sdk-rust

All four stable SDKs send X-Axonflow-Client: sdk-<lang>/<version> on every governed agent request. Existing v7.0.x callers continue to authenticate without the header.

Upgrade path

No migration required from v7.6.x — the new endpoints, webhook, and headers are additive. Operators wanting the verifier-only posture should set AXONFLOW_PLUGIN_CLAIMED_PUBLIC_KEY on the agent container and ensure the signing seed is held only by the billing service that mints tokens.

For the paid Pro tier to function:

1. Stripe account with the axonflow_plugin_pro Product + Price configured (use scripts/stripe-setup.sh from the platform repo).
2. Webhook endpoint registered in Stripe Dashboard pointing at <your-deployment>/api/v1/billing/stripe-webhook.
3. Webhook signing secret stored in AWS Secrets Manager and wired to the agent container as STRIPE_WEBHOOK_SIGNING_SECRET.
4. Email sending configured via RESEND_API_KEY (Resend is the default email provider).

Security + reliability fixes

• Stripe webhook idempotency held only on the day a token was issued. Issuer now passes IssuedAt explicitly into both the token and the INSERT so the persisted value matches what the token signs — replays on a different UTC day return the same byte-identical token.
• POST /api/v1/audit/search returns entries: [] (not null) on empty result sets.
• POST /api/v1/overrides rejects critical-severity system policies with HTTP 403. Authentication-bypass, time-based blind SQL injection, stacked DROP/DELETE/UPDATE/INSERT/EXEC, government IDs, and financial PII patterns are no longer overridable. Pre-existing active overrides on these policies are revoked at upgrade time.
• Per-IP rate limits behind ALB now key on the trusted last-hop IP (the ALB-observed peer) instead of the client-controllable first X-Forwarded-For entry.
• AWS Secrets Manager-derived secrets are trimmed at boot. RESEND_API_KEY, STRIPE_WEBHOOK_SIGNING_SECRET, AXONFLOW_INTERNAL_SERVICE_SECRET, JWT_SECRET, and LLM provider API keys are read via a dedicated helper that strips trailing whitespace.

References

• Plugin Pro — full $9.99 / 90-day Pro tier guide: comparison, buy flow, install per plugin, refund / revocation behavior
• Community SaaS deployment — registering a tenant, retrieving credentials, the Free baseline
• SDK Authentication — how the SDKs send credentials and which headers they set automatically
• Auth and header matrix — wire-level reference for X-License-Token, X-Axonflow-Client, and related headers
• License Matrix concept — six-quadrant aud model + missing-aud backward-compat fallback