Changelog

What changed in Veil. Private alpha.

Changelog

Veil is in private alpha. Breaking changes land without notice until v1.

2026-09-24 — Customer lifecycle, DR proof, monitoring

• Org lifecycle is live. Owner-gated DELETE /v1/members/{id}, POST|DELETE /v1/members/{id}/owner, self-delete DELETE /v1/me, and org teardown DELETE /v1/org — purges all vault rows in one transaction, audit survives as forensic record.
• Invites join the inviter’s org. Provisioning now honors the Kratos org stamp only when the Keto member tuple exists; otherwise a fresh org is minted.
• Backups are offsite. Daily dumps of all four databases land on the Railway volume and Cloudflare R2 via the backup-ingest worker. KEK stays separately escrowed — no single vendor loses both.
• Monitoring covers silent failure. veil-monitor alerts on stale backup/sweep heartbeats, /ready failures, audit-outbox backlog, and sustained origin 5xx (rolling errors_5m window in /ready).
• /privacy is live — what we collect, retention, deletion rights, and plain-English alpha terms.

2026-09-23 — Private alpha surface

• Invite-only access. Self-service registration is off. Org owners invite with veil human invite EMAIL; the invitee’s branded setup email arrives from noreply@veil.nyc and the link is their account setup. Re-inviting resends.
• POST /v1/invites added to the OpenAPI contract. Owner-authenticated; returns identity_id and emailed. Not MCP.
• Email is Cloudflare Email Sending behind mail.veil.nyc (Bearer-authed Worker, React Email templates, multipart text+HTML). Resend removed.
• First-party Hydra client is veil. The legacy password-manager client and password-manager audience are deleted; agent .hydra files now record their own audience as JSON.
• Env vars are VEIL_* everywhere. The PWM_* compatibility bridge is removed — rename before upgrading.
• veil.nyc/ is a landing page, and curl -fsSL https://veil.nyc/install.sh | sh installs the CLI and prints the full setup path.
• Login at login.veil.nyc no longer offers self-registration; direct visits to /registration explain invite-only alpha instead of a raw error.
• Keto, Hydra admin, and Kratos admin are internal-only — the stray public Railway domains are deleted.
• Invite emails carry the recovery code. The setup page asks for a one-time code; the invite now includes it alongside the link.
• Browser fill ships in the CLI. veil fill install registers the nyc.veil.fill native host and writes the Veil extension to ~/.veil/extension — load unpacked at chrome://extensions (Developer mode). Touch ID gates every fill; secrets never sit in browser.storage.

Agents

Agent tokens mint aud=veil. If a .hydra credential file predates the audience migration it still reads — bare legacy files resolve to the audience they were bound under. veil agent hydra <name> --force rotates a binding onto veil explicitly.