OriginChain release notes — what shipped, when.

Transactional email, crash-injection in CI, shape-level diagnostics, and a fistful of dashboard fixes.

• feat Forgot- and reset-password flow shipped end-to-end. Request a reset link from /forgot, set a new password from /reset-password — single-use, time-limited tokens delivered through our managed transactional email service.
• feat Magic-link login and password-reset emails now go through our managed transactional email service. Delivery is signed, DKIM-authenticated, and falls back to a journal log if the provider has a hiccup so you never lose access.
• feat Engine-level shape diagnostics: GET /diagnostics/shape-stats returns per-shape p50/p95/p99 latency, queries-per-second over the last minute, total-call count, and per-shape storage bytes. Plug it into any Prometheus-style scraper.
• feat Crash-injection harness lives in CI. Every commit panics the engine at four critical boundaries (pre-fsync, post-fsync, mid-batch, replay) twenty times each — recovered state must be a prefix of a known-good model. 4×20 = 80 green on every push.
• feat Optimiser landed on the hot path: cost-based shape routing now picks the cheapest plan from a small fixed menu instead of always taking the first match. No tuning knobs to learn.
• feat Synchronous-replica catch-up now uses an explicit sync state-machine — followers report lag in real time and the primary refuses to ack writes until the standby is caught up.
• feat Tier-upgrade flow in the dashboard: change compute tier from Whisper → Thunder → Storm without recreating the instance. Rolling resize, no downtime, prorated on the next bill.
• fix Billing math: monthly spend now includes only running instances. Stopped instances no longer accrue compute charges in the current-cycle estimate (storage still does, since data still lives on disk).
• fix Admin login: the auth-gate IIFE no longer fires on / or /magic-link, so the reload loop reported on a few accounts is structurally impossible. Login form is always interactive, even before boot-status comes back.
• fix Dashboard /app/backups: hoisted the tenant-ownership check out of an N+1 loop and translated AbortError into a friendly retry banner. List-backups no longer SIGNAL_ABORTED on instances with hundreds of backups.
• fix Console snapshot list now caches results for 30 s and the SDK times out at 60 s — slow snapshot directories no longer hang the page.
• fix Public docs: scrubbed a leaked tenant ULID and replaced with the acme.* placeholder used elsewhere.
• fix Crash-replay test corpus expanded — every persisted shape now has a deterministic replay test.
• perf Per-repo CI: each crate, each SDK, and the frontend run in their own pipeline. Builds that don't touch a target skip its tests entirely — typical PR feedback dropped from ~9 min to ~2 min.
• docs New blog post: "Schedule a panic at every fsync boundary" — how the new crash-injection harness works and why it caught two real bugs the day it landed.
• docs New blog post: "One WAL frame, every shape" — how multi-shape writes commit atomically through a single write-ahead log frame.
• docs New blog post: a deep-dive on how the cost-based optimiser picks shape routes.

Marketing surface, MCP server, and an OpenAPI 3.1 spec — built so AI agents and humans can both read OriginChain.

• feat @originchain/mcp-server published — a Model Context Protocol server that exposes /rows, /query, /ask, /watch, and the add-on shapes to any MCP-aware client (Claude Desktop, Cursor, etc.). Drop in your bearer, point at your endpoint, you're live.
• feat OpenAPI 3.1 spec published at /openapi.json — every public HTTP endpoint, every schema, every error code. Generate clients in any language, or paste it straight into your editor's HTTP plugin.
• feat Eight head-to-head comparison pages: OriginChain vs Postgres, MongoDB, Neon, Supabase, Pinecone, Qdrant, Weaviate, and Milvus. Honest about where each tool wins and where ours does.
• feat Site-wide search via Pagefind. Hit the search input on any page, get instant results across docs, blogs, and marketing pages — fully static, no backend, works offline once cached.
• feat Public /roadmap page with the real depth-first plan to 1.0 and beyond — HA, fuzzing, optimiser, EXPLAIN, multi-writer, online-schema. No sandbagged dates.
• feat Real /status page wired to the same metrics the on-call dashboard reads. Per-region uptime, 30-day incident history, current SLO burn.
• feat Schema delete in the dashboard: drop a key shape from the console with a typed-confirmation guard. Backed by new DELETE endpoints in oc-http (DELETE /v1/schemas/:name with cascade flag).
• feat Per-page Open Graph images: every marketing page renders a tailored OG card with its own title and category, so links look right on Slack, Twitter, LinkedIn, and Discord.
• feat Mobile hamburger navigation across the marketing site, with dark theme as the default. Light theme toggle still available.
• feat IndexNow ping on every deploy — search engines hear about new docs and blog posts within seconds of merge.
• feat Three new long-form engineering blog posts on storage internals, replication, and the new add-on architecture.
• fix Go SDK: corrected the module path to github.com/originchain-ai/originchain-go. `go get` and `go mod tidy` now resolve correctly.

Seven new paid add-ons attach to any tier — opt in only what your workload needs.

• feat SQL Pro add-on ($49/mo): GROUP BY with COUNT/SUM/AVG/MIN/MAX, INNER + LEFT/RIGHT/FULL OUTER joins, HAVING filters, and chained 3+ table joins (left-deep, up to five tables).
• feat Vector Search add-on ($79/mo + $0.0002 per topk): HNSW with cosine, dot, L2 metrics and tunable speed/recall. Default high_recall mode hits recall@10 = 0.96 at 100k vectors with p99 109 ms; fast mode runs p99 37 ms at recall 0.69. Filtered topk via metadata equality, f32 SIMD distance kernels, deserialized graph cache.
• feat Full-Text Pro add-on ($49/mo): Lucene-default BM25 (k1=1.2, b=0.75), phrase queries via position-list intersection, UAX #29 Unicode tokenizer, and Snowball stemming for 18 languages.
• feat Graph add-on ($59/mo): forward and reverse one-hop neighbors (correct on self-relations), BFS up to a configurable max depth, path reachability, and weighted shortest path (Dijkstra) with caller-supplied weight functions.
• feat Transactions add-on ($99/mo): multi-row snapshot-isolation transactions with optimistic conflict detection — begin / get / put / delete / commit / abort across multiple rows.
• feat Intra-Segment PITR add-on ($149/mo): sub-second LSN-precise point-in-time recovery via WAL frame v2 with embedded microsecond timestamps and a continuous tail-shipper.
• feat Multi-Writer Cluster add-on (Enterprise): three-node consensus cluster with TLS transport, persistent disk log, and bespoke setup by the OriginChain team.

OriginChain reaches general availability on AWS — single-tenant, region-isolated, sub-100 ms in-region p99.

• feat Single-tenant region-isolated compute live in Asia Pacific (Mumbai). Each instance gets a dedicated host, a private write-ahead log, and an HTTPS endpoint provisioned in about two minutes.
• feat Synchronous replication on every paid tier: RPO = 0 — every commit is acknowledged by the standby before the client sees success.
• feat Three compute tiers (Whisper, Thunder, Storm) and four storage tiers (20 GB to 2 TB). Resize compute and storage independently, hot, with no downtime.
• feat Console-driven bearer rotation with a 60-second grace window for rolling deploys.
• perf p99 read latency under 8 ms in-region on Thunder and Storm; cached /ask responses return in under 50 ms.

Promoted-follower failover verified end-to-end on live infrastructure.

• feat Snapshot-bootstrap: a new follower can join a running primary without operator intervention, receiving a consistent snapshot before tailing live frames.
• feat Failover preserves full state — promoted follower serves reads and writes immediately on takeover.
• perf Recovery time objective (RTO) measured at approximately 25 seconds in our drills.
• perf Active-passive synchronous replication remains the production path; no in-flight commits lost on failover.

Engine, control plane, and Razorpay billing go live.

• feat Managed control plane: signup, region selection, tier selection, instance provisioning, console with metrics and audit log access.
• feat Razorpay billing integration: USD pricing, monthly and annual cycles, prorated mid-cycle changes, hosted card capture for trials.
• feat 7-day Whisper trial — one per account, real endpoint with real backups, no charge during the trial.
• feat Encrypted nightly backups with daily integrity checks; sealed-segment point-in-time recovery on every paid tier.
• feat Python SDK — fully typed, sync and async, with helpers for /rows, /query, /ask, /watch, /sql, /vector, /fts, /graph.

Natural-language compile path moves to AWS Bedrock with Claude Sonnet 4.6.

• feat Every /ask call compiles through AWS Bedrock — Claude Sonnet 4.6 — in the same region as the tenant's instance. SigV4 auth via the instance's IAM role; no API keys anywhere in the stack.
• feat Schema prompt caching: repeated /ask calls with the same catalog pay the cached-read rate (~90% discount on repeated catalog tokens).
• feat Tenant IAM role scoped to bedrock:InvokeModel on Claude Sonnet only — no other foundation models, no cross-account access.
• perf Shared tokio runtime + per-region Bedrock client cache; SDK startup cost is paid once per process, not per /ask.

Hot-path concurrency, atomic backups, chaos and load harnesses.

• feat MVCC-lite on hot-path writes — conflicting updates serialize per row without blocking reads.
• feat oc backup create / oc backup restore — atomic at the filesystem level, with daily integrity checks.
• feat Chaos and load harnesses run on every build (process kill, disk full, torn fsync; 10k rps steady-state).
• feat HTTP body limit enforced at 8 MiB; rate limiter is a real token bucket with Retry-After headers.
• perf Hot index switched from Mutex to RwLock — p50 reads down ~18%.

Live views over Server-Sent Events; durable plan cache.

• feat New /v1/watch endpoint — Server-Sent Events stream of updates for a live expression. Same protocol across every region and tier.
• feat Plan cache spills to disk; cold start reloads hot plans without re-invoking the LLM.
• perf Catalog lookup is lock-free; consult cost dropped to ~12 µs.

Single hash-keyed substrate replaces the multi-engine split.

• breaking Storage consolidated onto a single hash-indexed key/value store with a write-ahead log — one recovery path, one backup path, one mental model. Earlier multi-engine split removed.
• breaking Parquet, Arrow, DataFusion, and KuzuDB dependencies dropped.
• feat Plans compile down to index, ref-walk, and range-scan primitives on the unified store. Cost-based routing retired — no routing to do.

Initial public release.

• feat HTTP ingress, row-keyed store, and the natural-language to query-plan compiler land for the first time.
• docs Specification document published; HTTP API documented.