1.27.0 — Safe secret failures, private Assistant history, and chat moderation control

2026-09-13

Adds a runtime chat moderation switch and repairs secret storage, conversation privacy, and test reliability. KMS secret readers and key-backed Assistant integrations must account for changed access behavior.

Breaking

• KSMSecrets now raises SecretsUnavailableError when stored secrets cannot be decrypted. Update callers that relied on empty mappings or default values during KMS failures.
• Key-backed sessions can no longer read Assistant conversation history, including when assuming an owner's identity.

Added

• CHAT_MODERATION_ENABLED, enabled by default, supports disabling advisory chat classification through file settings or a global runtime Setting with boolean coercion.

Fixed

• Failed KMS reads cannot overwrite unread secrets. Recovery retries, ciphertext replacement, and refresh now handle cached secret state safely.
• Test reports account for skipped tests and mixed package/file selections. Test fixtures use correct filesystem ownership and avoid shared Redis flushes.

Security

• Ordinary Assistant users can read only their own conversations. Global view_admin oversight remains; foreign reads through the conversation REST endpoint are audited without conversation contents.
• Secret setters no longer log plaintext values.

Upgrade notes

• Disabled chat moderation stores allow / [] / null on new sends and accepted edits; edits clear previous scores. Explicit room rules remain active. Historical messages and idempotent retries are unchanged.
• Upgrade every chat writer and check application/file-caption fallbacks before relying on the moderation switch.
• No database migrations are required.