[scttfrdmn]

Release v0.163.0: moves Unreleased to ## [0.163.0] - 2026-11-10. Minor: chat-platform commands now refuse without an opt-in.

• feat: wall off chat-platform integrations for 1.0 (SPAWN_EXPERIMENTAL_CHAT) #1570: chat-platform integrations (Slack/Teams/Discord, spore-bot, SMS) walled off for 1.0 behind SPAWN_EXPERIMENTAL_CHAT=1 / experimental.chat. Hosted-bot defaults removed. dashboard-api Slack endpoints are gated off (keep the variable unset on spawn-dashboard-api; see the deploy checklist note).
• notify: tighten Teams workspace validation (GHSA-ccj3-jfqj-m3mh companion) #1571 (security): notify workspace add --platform teams refuses --signing-secret; companion to the published GHSA-ccj3-jfqj-m3mh.
• docs(spore-bot): point the self-host template and infra doc at the rotation guide #1568: docs pointer to the rotation guide.

Advisories published 2026-11-10: GHSA-xqx8-pcpv-cx2h (patched 0.162.0), GHSA-ccj3-jfqj-m3mh, GHSA-56x2-qf66-3cf2.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Deploy checklist: v0.162.0..v0.163.0

Operated components whose deploy inputs differ between v0.162.0 (4f24fa1) and v0.163.0 (74a4132), from scripts/deploychecklist (#1444). code-only: only compiled inputs changed, so a code update ships it. manual: a script, template, policy or mapping changed; review and apply it by hand. Deploy from a clean checkout of v0.163.0. How to read this: docs/infra-account.md, "Deploy checklist".

Lambdas (4 of 9 need a deploy)

• lambda/dashboard-api (spawn-dashboard-api): changed, code-only
  • compiles lambda/dashboard-api: chat_gate.go (added), main.go
  • deploy (shell): lambda/dashboard-api/deploy.sh [aws-profile]
  • deploy (shell): lambda/dashboard-api/scripts/deploy.sh
  • note: Slack endpoints (/api/slack/*) answer 404 unless the function's environment sets SPAWN_EXPERIMENTAL_CHAT=1; the hosted spawn-dashboard-api must NOT set it for 1.0 (spore-bot: decrypt the KMS-encrypted workspace signing_secret (spawn#868) spore-host#611). Check with aws lambda get-function-configuration --function-name spawn-dashboard-api --query Environment.Variables.SPAWN_EXPERIMENTAL_CHAT. (lambda/dashboard-api/chat_gate.go)
• lambda/pipeline-orchestrator (spawn-pipeline-orchestrator): changed, code-only
  • compiles pkg/config: config.go, endpoints.go, experimental.go (added)
  • deploy (sam): make -C lambda/pipeline-orchestrator deploy
• lambda/sweep-orchestrator (spawn-sweep-orchestrator): changed, code-only
  • compiles pkg/config: config.go, endpoints.go, experimental.go (added)
  • deploy (shell): scripts/deploy-sweep-orchestrator.sh
• lambda/ttl-reaper (spawn-ttl-reaper-production): changed, code-only
  • compiles pkg/config: config.go, endpoints.go, experimental.go (added)
  • deploy (sam): make -C lambda/ttl-reaper deploy

Unchanged, no deploy: lambda/cost-history-collector, lambda/dashboard-websocket, lambda/dashboard-websocket-processor, lambda/dns-updater, lambda/scheduler-handler.

Other deploy inputs (2 of 26 changed, all manual)

• deployment/cloudformation/bot-cross-account-role.yaml: changed. CloudFormation/SAM template
  • no script in the repo applies it: deploy by hand
• deployment/cloudformation/spore-bot.yaml: changed. CloudFormation/SAM template
  • no script in the repo applies it: deploy by hand

Shipped with the CLI, no deploy

• pkg/reaperdeploy: creates a Lambda from Go inside the spawn CLI (the self-hosted reaper, in the user's own account), so it ships with the CLI release, not as a spore.host deploy

[github-actions]

Lambda deploy record: v0.162.0..v0.163.0, LIVE

From scripts/deploylambdas (#1445): code-only Lambda changes, deployed by the approval-gated production job. How to read it: docs/infra-account.md, "Deploying code-only changes from CI".

Function	Result	CodeSha256 before	built	after	Config diff	Version stamp
spawn-dashboard-api	deployed	IRO9A2w8nZcvyiDG4NjIBWAps1JKfNO52nHrBtgqtLs=	9/4GnnEB/EeT0hbtWDc/hYSTXVBvnQERVDARsJOKENM=	9/4GnnEB/EeT0hbtWDc/hYSTXVBvnQERVDARsJOKENM=	empty	spawn:version=0.163.0 (verified)
spawn-pipeline-orchestrator	deployed	ewV2dKjMQ1nooFYicWbMFxVINIlWHnEN7vJeMYU1grs=	0D+9jPQSq9i7qcfUOuNJ7hi693JwPTI61h5wH7i/JTQ=	0D+9jPQSq9i7qcfUOuNJ7hi693JwPTI61h5wH7i/JTQ=	empty	spawn:version=0.163.0 (verified)
spawn-sweep-orchestrator	deployed	3AfhC1p3OOvPvpI3j3zDEUV3W/00HOZVLsCnVGvHcjI=	ah9JpZ7JSEf6oOgGr9GuyzZQ2VsmvpmN4yJ9F8MykZc=	ah9JpZ7JSEf6oOgGr9GuyzZQ2VsmvpmN4yJ9F8MykZc=	empty	spawn:version=0.163.0 (verified)
spawn-ttl-reaper-production	deployed	nFWVjB3Q+M5mnMzb+bJowRzn5RQeBvJ4CNJRUejV4qA=	sENMQHESLCRrZx44N5j5//KepbIEH4v7y9eL4Ng8QEY=	sENMQHESLCRrZx44N5j5//KepbIEH4v7y9eL4Ng8QEY=	empty	spawn:version=0.163.0 (verified)

• spawn-pipeline-orchestrator:

  • SAM-managed, stack spawn-pipeline-orchestrator: after this update the stack's Code and Version parameter still name the previous deploy; that drift is expected and the next make -C lambda/pipeline-orchestrator deploy from a release tag reconciles it (docs/infra-account.md)

• spawn-ttl-reaper-production:

  • SAM-managed, stack spawn-ttl-reaper-production: after this update the stack's Code and Version parameter still name the previous deploy; that drift is expected and the next make -C lambda/ttl-reaper deploy from a release tag reconciles it (docs/infra-account.md)

• published bootstrap body for v0.163.0 verified (sha256 3563692d194f446e3aca50030b0e6a24a9fb15a87594daf30b46271f0e93f739)

Not deployed by this job

• lambda/cost-history-collector (spawn-cost-history-collector) (unchanged, none): unchanged, no deploy
• lambda/dashboard-websocket (spawn-dashboard-websocket) (unchanged, none): unchanged, no deploy
• lambda/dashboard-websocket-processor (spawn-dashboard-websocket-processor) (unchanged, none): unchanged, no deploy
• lambda/dns-updater (spawn-dns-updater) (unchanged, none): unchanged, no deploy
• lambda/scheduler-handler (scheduler-handler) (unchanged, none): unchanged, no deploy
• deployment/cloudformation/bot-cross-account-role.yaml (changed, manual): manual, not deployed: CloudFormation/SAM template
• deployment/cloudformation/spore-bot.yaml (changed, manual): manual, not deployed: CloudFormation/SAM template

[scttfrdmn]

Deploy record: v0.163.0, 2026-11-10, infra account 966362334030

The CI Deploy code-only Lambdas job (run 42743961933) was owner-approved and succeeded. Snapshot vs post-deploy:

Function	CodeSha	Config	Version tag
spawn-dashboard-api	IRO9A2w8→9/4GnnEB	no drift	0.163.0
spawn-pipeline-orchestrator	ewV2dKjM→0D+9jPQS	no drift	0.163.0
spawn-sweep-orchestrator	3AfhC1p3→ah9JpZ7J	no drift	0.163.0
spawn-ttl-reaper-production	nFWVjB3Q→sENMQHES	no drift	0.163.0
scheduler-handler	unchanged	no drift	0.162.0 (not in this checklist)

Checklist note: SPAWN_EXPERIMENTAL_CHAT is unset on spawn-dashboard-api; https://api.spore.host/api/slack/oauth → 404.