Every release, named — with the hedges still loud.
ARIA ships frequently. Every release here maps to a public git tag on simplification-io/aria. The honest-hedge contract holds: SHIPPED means it's in production today; IN PROGRESS means we're building it now; PLANNED means it's on the roadmap. We never upgrade hedges to certainties.
What this page is, and what it isn't.
This is a curated highlights view of the most recent releases — the ones that move the platform's posture forward in ways prospects, customers, and AI assistants want to know about. The full machine-readable changelog is in the repo at CHANGELOG.md and the full release diff is published at GitHub Releases. If your procurement team wants every commit, every migration, every single-line patch — it's all there. We don't squash history.
v1.9.5.X arc — 35 tags shipped in extended single-session work.
- v1.9.5.5.6 · 2026-05-07SHIPPED
Hot-fix: /mcp redirect loop closed
Marketing front door for the MCP service was caught in an infinite 307↔308 loop on simplification.io/mcp because three slugs added to next.config.mjs redirects() in v1.9.5.2.7 were never added to the next-intl middleware exclusion regex. Codified as recurring pattern §60. /changelog and /customers scaffold pages added in the same tag.
- Single canonical BUG_TRACKER at aria-simplification/docs/ (platform copy retired · CI gate archived)
- /mcp /changelog /customers all return 200 from canonical URLs
- Recurring pattern §60 codified — middleware matcher must mirror redirects() table
- v1.9.5.5.5 · 2026-05-06SHIPPED
Dark-mode root cause closed (5-day chase)
Five soft accent tokens were defined in :root but missing in the dark theme block, so every dark surface re-mapped them to default fallbacks and rendered invisible. Single-source-of-truth fix in landing.css + trust-center.css. New recurring pattern §59: every CSS variable in :root MUST have a dark counterpart.
- v1.9.5.5.3 · 2026-05-07SHIPPED
MCP server runtime hot-fix
structlog ModuleNotFoundError closed by switching to stdlib logging across rate_limit · metrics · usage_log. asyncpg URL params TypeError closed by passing connect_args dict instead of query-string params (?statement_cache_size=0 was being validated as int by asyncpg, fed in as string).
- v1.9.5.4 · 2026-05-06SHIPPED
Marketplace Playbooks GA (Path 4)
Path ladder complete: built-in (v1.9.5) → curated by ARIA staff (v1.9.5.2) → per-customer org-scoped (v1.9.5.3) → marketplace community-submitted (v1.9.5.4) → AI-generated (v1.9.5.10.1). 4-track parallel ship: DB primitives + API endpoints + admin review queue + customer browse/install. Honest hedge: marketplace Playbooks are creator-published. ARIA reviewed for safety but does not endorse outcomes.
- Tier-cap matrix: Solo:5 / Starter:20 / Growth+:∞ installs
- Brand-lock invariants enforced via shared 8-phrase banlist
- 44 marketplace tests + 13 brand-lock vitests + e2e Playwright spec
- v1.9.5.2.5 · 2026-05-06SHIPPED
CRITICAL: MCP multi-tenant data-leak closed
Singleton bearer in async MCP server leaked identity across tenants. Closed via contextvars.ContextVar for the bearer + middleware that sets it from Authorization on every request. Per-tool scope check now reads request.state.oauth_scopes — never a process-global. 4 HIGH bugs cleared in the same tag. Recurring pattern §56 codified.
- v1.9.5 · 2026-05-06SHIPPED
MCP service LIVE at mcp.aria.simplification.io
Streamable-HTTP transport · TLS valid · 21+ tools across 8 brand layers · 6+ Playbooks. Pika-style marketing front door at simplification.io/mcp. ChatGPT Custom GPT bridge + OpenAI Agents SDK shipped in v1.9.5.15 (npm aria-openai-agents · PyPI aria-openai-agents · PyPI aria-cx-mcp). PyPI publish + Anthropic Connectors directory submission queued for v1.9.5.14 closure tag.
- v1.9.4.9 · 2026-05-05SHIPPED
Stripe LIVE end-to-end · Wave-1 commerce path proven
5 ARIA products in Stripe LIVE (Solo $29 · Starter $99 · Growth $249 · Agency $499 · Enterprise contact-sales). Webhook with 28 events at api.aria.simplification.io. Customer Portal enabled. End-to-end verified via send_invoice (no real charge): Stripe → webhook → signature verified → billing_events dedup → subscriptions row insert → orgs.tier flip → audit log entry.
- alembic head 0059_subscriptions_add_solo_tier
- Railway preDeployCommand auto-runs alembic on every deploy
- Doppler aria/dev=TEST keys · aria/prd=LIVE keys (rotated by operator)
- v1.9.0 · 2026-05-05SHIPPED
i18n + marketing + legal pages + dark mode
next-intl 3.26 with /en /fr /ar locales + RTL. Marketing pages /about /pricing /careers /contact + Footer 12 anchors + 4 schema.org JSON-LD. Legal DRAFT pages /terms /privacy /cookies /security /dpa /aup with per-jurisdiction cookie middleware (BLOCKED on counsel sign-off — last 2% of Wave-1 readiness). Comprehensive dark mode + WCAG color-contrast fixes + mobile drawer focus-trap.
What we're working on right now.
We name in-flight work because the alternative — pretending everything's already shipped — would be lying. These items close in days or weeks, not quarters.
v1.9.5.14 closure tag
operator-gatedPyPI publish aria-cx-mcp + Anthropic Connectors directory submission · gated on PYPI_API_TOKEN_ARIA + Anthropic credentials in Doppler
Counsel sign-off on 6 W3 legal pages
Wave-1 final 2%Terms · Privacy · Cookies · Security · DPA · AUP — drafts published with honest hedge; final lock pending counsel review
Doppler-Railway integration toggle (§K permanent fix)
operator one-time action ~10 minRecurring pattern §K hit 7+ times · runbook at docs/internal/runbooks/railway_doppler_integration.md
SOC 2 Type 1 certification
Q3 2026 targetedAudit in-progress. Until certified we say 'in-progress' — never 'certified'.
Want the full diff?
The public git history has every commit, every migration, every test. We don't squash. Procurement teams pre-qualify us by reading it.