AiSOC v20.2.0 — the first-run-truth release

[beenuar]

AiSOC v20.2.0 is out: https://github.com/beenuar/AiSOC/releases/tag/v20.2.0

This is the first-run-truth release — the one where installing AiSOC on Windows became as real as it already was on Linux and macOS, and where the install documentation was made to describe the product you actually get.

Highlights

• Windows first run works end to end. install.ps1 now generates .env secrets with the same generator make up uses (it previously copied a template the API refuses to boot on — correctly, since secure defaults reject empty secrets in production), and it resolves port conflicts the same way the Makefile does instead of asking you to hand-edit docker-compose.yml. A windows-latest CI job now proves every generated secret lands non-empty, so this cannot silently regress.
• Install docs tell the truth. The quickstart now states the measured requirements (8 GB memory / 20 GB disk), the installation page says sixteen CORE containers (the old "fourteen" was spelled as a word, which is how it survived every digit-based check — the gate now reads number words too), and the four surfaces that advertised a Swagger URL the production stack answers 404 on were corrected.
• Every on-ramp can prove itself. The Render blueprint is gone (it deployed a stack with no ingest and no fusion — a populated console that cannot answer whether the pipeline works), and the devcontainer and sandbox README now hand off to make up like everything else.
• Jira connector repaired. Jira Cloud removed GET /rest/api/3/search (410 Gone on every poll); the connector now uses GET /rest/api/3/search/jql with the same field set, so normalization is unchanged.
• The image stable channel guard fails closed. It had read an empty registry response as "first release" and carried the channel across the v19 → v20 application major under green runs. It now reads the registry HTTP API with three states — and a tag that is present but unreadable blocks the channel, because refusing is recoverable and a wrong crossing is not. Both stable channels were verified unmoved after this release published (chart at 7.8.0, images at v19.0.0, by deliberate owner decision).
• Dependency queue at zero. qs moves to 6.17.0 (GHSA-6pq8-jhm2-2vcw); the two remaining deepmerge alerts have no patched version published, so they are dismissed on recorded evidence rather than left ambiguous — their only dependents are dev/build tooling merging repo-authored configs, and the dismissal names the re-check condition.

By the numbers

11 defects were fixed in this release, and 34 across it and the two releases before it (11 here, 11 in v20.1.0, 12 in v20.0.0 — counting distinct product or CI defects named in each release's Fixed and Security sections, with dependency-version advisories excluded). No breaking changes. The Helm chart publishes as 7.11.0.

Full details in CHANGELOG.md and RELEASES.md.

Thanks to everyone filing issues and reports — the Windows install work in particular came straight out of a clean-room install following the README on a machine that already ran Postgres and Ollama, which is exactly the environment this audience has.