Skip to main content

TideCloak 0.14.1

Summary​

TideCloak 0.14.1 stabilises the 0.14.0 IGA consolidation release. The headline fix is a boot-safe Keycloak 26.7.0 migration path that resolves a 409 startup crash on realms with pending change requests — the fix that makes the consolidated IGA code survive the upgrade. The release also lands a cluster of IGA toggle and first-admin stability fixes, extends governance coverage for DELETE_REALM, client origin URLs, CREATE_CLIENT attestation units, and coalesced client updates, and adds new release-enforcement tooling.

Key Features​

Boot-Safe Keycloak 26.7.0 Migration : Boot-time 409 crash on realms with pending change requests is fixed. Keycloak's 26.7.0 organisation-admin migration roles are now captured as pending change requests (IgaMigrationRoleCapture) instead of applied directly, and IGA capture is suppressed during Keycloak model migrations. Together these make the consolidated IGA code survive the 26.7.0 upgrade.

IGA Toggle & First-Admin Stability : A cluster of fixes across toggle-iga and firstAdmin — 409 regressions on toggle-on, sign-at-toggle deadlock and NPE, correct ADOPT_* handling, fail-loud behaviour instead of silent-stub, and per-change-request sweep failures now surface instead of failing silently.

Expanded Governance : DELETE_REALM promoted to a first-class governed change request. Client origin URL changes are now governed and re-signed. CREATE_CLIENT extended to cover the full owned attestation-unit family. Multi-field client PUTs coalesced into per-request change requests, fixing a self-conflicting 409 loop. Automatic IdP settings re-sign on client-settings commit. Default roles are now correctly granted to Tide self-registration and link-tide enrollees.

iga-core Consolidation : IGA functionality consolidated into a single iga-core module for cleaner surface area and ownership.

Approval Enclave UX : Plain-language, action-neutral approval cards with human-readable model builders for AttestationUnit:1 and ServerCert:1. Paired with a tide-js TideError sweep and consistent Problem Details parsing.

Release Tooling : Added enforce_release.yml release-enforcement workflow and pull request template.

Enclave SRI : sha256-Jh9JUL5gvw/gia2jlXnWF54v1bYcbqT4zIubyT+fzpU=

Detailed changelog​

For a granular per-repository breakdown of changes (Midgard, Heimdall, ORK, Ragnarök, TideJS, TideCloakJS, Asgard, master-libs, tidecloak-idp-extensions, tidecloak-iga-extensions, tidecloak-override, and upstream Keycloak), see the detailed changelog.