AiSOC v20.1.0 — a data-loss fix, honest harnesses, live probes, and a channel incident closed

[beenuar]

AiSOC v20.1.0 is out: release notes · changelog · docs.

What this release does for you

• A data-loss defect in every connector's poll loop is closed (contributed by meshreyy). Ingest reports per-event normalization failures inside an HTTP 200, and the scheduler advanced its checkpoint on HTTP success alone — so a partially rejected batch moved the cursor past events that were never stored. The cursor now advances only when every submitted event was accepted; a rejected page is re-fetched on the next overlapping poll and deduplicated.
• The API answers unauthenticated liveness and readiness probes — GET /api/v1/health and GET /api/v1/health/ready, with database blocking at 503 and cache degrading at 200 — so a load balancer can finally make the right call without a credential. Operations docs.
• The measurement harnesses got as honest as the product. The live-agent eval runs one event loop per run and scores failed investigations as 0 with the reason recorded (dropping them was survivor bias); the 0.40 groundedness floor was re-derived under the fixed harness and holds. The weekly chaos store-outage legs now grade real service behaviour instead of artifacts of their own probe contract — the redis and qdrant legs pass end to end; the postgres leg stays red by design while Chaos store-outage graders fail weekly: services do not degrade, announce, or reconnect the way the graders require #1446 is open, and that red is the workflow doing its job.
• fastapi 0.146.0 across all 32 declaration sites and 13 locks in one move, the Oct-22 dependency waves folded, and @vitest/mocker 4.1.12 closing CVE-2026-112949/112950 in all three npm lockfiles.
• Every console screenshot in the README and docs is freshly captured from this release running the real stack — real pipeline data, the bundled local model's actual triage verdicts, the live CISA KEV feed. Sample data is labelled aisoc_sample wherever it appears.

Defects addressed

23 distinct defects across the last two releases — 11 in v20.1.0 and 12 in v20.0.0, counting the product and CI defects named in each release's Fixed and Security sections; dependency-version advisories are not counted.

One incident, found and closed by this release's own verification

Verifying v20.1.0 from the registry (rather than from the green workflow) surfaced that the image stable channel had silently crossed the v19 → v20 application major: the release guard read the channel's position through a docker buildx template that stopped resolving on current runners, the empty read was treated as "first release", and both the v20.0.0 and v20.1.0 publishes moved the tag. The chart channel held throughout because it reads the registry API directly. The guard now reads the same way and fails closed — a present-but-unreadable channel blocks instead of moving — with the rule pinned by tests that execute the workflow's own decision block, and a dispatchable image-channel.yml repair tool (the image twin of chart-channel.yml). The channel has been restored to v19.0.0 for all 16 images, with before/after evidence per image in the repair run. If you pull :stable, you are on v19.0.0, exactly where the channel policy says you should be until a deliberate promotion.

Channel positions after this release

• vX.Y.Z tags: immutable, v20.1.0 published for all 16 images and the chart (7.10.0).
• latest: v20.1.0.
• stable (images): v19.0.0. stable (chart): 7.8.0. Both held deliberately; a major is crossed only by an explicit promotion.

Thanks to meshreyy for the checkpoint fix and the CI registry fallback in this release.