Sardis

Sardis v0.9.5: Strict Live Mode + Operations Hardening

v0.9.5 ships strict live-mode controls, replay/idempotency proof gates, SLO alerting, DR evidence automation, and runtime security-policy preflight visibility.

v0.9.5 focuses on production discipline: strict live-mode boundaries, deterministic replay protection, operations alerting, and verifiable incident evidence artifacts.

What shipped

  • Strict live-mode guardrails on critical payment execution paths.
  • Idempotency and replay-proof release gates for webhook and payment pipelines.
  • SLO dashboard and PagerDuty-ready alert routing for production operations.
  • DR drill evidence automation with measured RTO/RPO artifact generation.
  • Runtime security-policy preflight surfaced directly in dashboard demo flow.

Why this matters

Agentic payments need deterministic controls even under provider outages or adversarial traffic. This release raises the default posture from "works" to "provably safe": deny on ambiguity, preserve evidence, and keep operators inside explicit runbooks.

Operator checks now exposed

  • GET /api/v2/checkout/secure/security-policy
  • GET /api/v2/cards/asa/security-policy
  • GET /api/v2/a2a/trust/security-policy
  • GET /api/v2/cards/providers/readiness

Combined with secure checkout evidence exports, these endpoints give operators a deterministic control-plane snapshot before and after execution.

Next up is live provider certification and PCI boundary finalization. See Changelog for details.