https://caisson.sh/updates Compliance-grade infrastructure updates: new modules, control mappings, and framework coverage. en-us Thu, 30 Jul 2026 00:00:00 GMT https://caisson.sh/updates#kernel-browser-safe-v0-6 https://caisson.sh/updates#kernel-browser-safe-v0-6 Thu, 30 Jul 2026 00:00:00 GMT @caisson/kernel reaches 0.7.0 and its main entry no longer reaches a Node built-in, so packages built on it — the trust-page generator and the artifact renderer among them — can be imported directly into a browser bundle. Everything that needs Node moved to a new @caisson/kernel/node entry point: constant-time secret comparison, audit-chain hashing, migration assembly, and the SSRF guard. That entry re-exports the main one in full, so server code that uses a moved function changes one import path and keeps the rest of its import list; nothing changed about what any of them do. If you import verifyChain, safeEqualFixed, assembleMigrations, or any of the SSRF helpers, point that import at @caisson/kernel/node — type-only imports need no change. Separately, a partial refund now reduces what a purchase counts as paid, so an upgrade quote credits what you were actually charged rather than the original amount, and a refund notice that names the same purchased line twice is rejected outright instead of being half-applied. The reference compliance pack gains a fourth control, risk identification and assessment, evidenced by a traversal of a scored AI risk register. @caisson/frameworks-pack gains a @caisson/frameworks-pack/registry entry point exposing the control model on its own. Full per-module detail ships in each package's changelog. https://caisson.sh/updates#oscal-spine-v0-5 https://caisson.sh/updates#oscal-spine-v0-5 Tue, 28 Jul 2026 00:00:00 GMT The OSCAL surface — catalog loading, profile resolution, and component-definition assembly — moves out of the bundles it was embedded in and ships as @caisson/oscal-spine, installable on its own and included for Compliance and Everything buyers. field-crypto changes shape underneath: key material now lives in a request-scoped context that is provisioned when the context binds and zeroized when it unbinds, and callers borrow a key for the length of one operation instead of receiving one to hold. A key-management adapter for Azure Key Vault and an immutable-storage adapter for Azure Blob are available for deployments that want the key or the archive outside the application. Background jobs gain an Inngest v4 driver alongside the existing Trigger.dev, pg-boss, BullMQ, and in-memory ones. Current prices for every module and bundle are on the marketplace page. https://caisson.sh/updates#catalog-release-v0-4 https://caisson.sh/updates#catalog-release-v0-4 Sun, 12 Jul 2026 00:00:00 GMT A coordinated release across the whole module catalog. The registry now enforces an installable-version guarantee: every advertised version of every module resolves to a downloadable, hash-verified tarball, checked in CI before anything ships. Purchases and renewals send lifecycle confirmation emails. The kernel reaches 0.4.3, project templates track it, the support bot's answer quality is regression-gated against a recorded baseline, and modules across the catalog pick up hardening and fixes. Full per-module details ship in each package's changelog. https://caisson.sh/updates#base-substrate-v0-3 https://caisson.sh/updates#base-substrate-v0-3 Sat, 27 Jun 2026 00:00:00 GMT The Caisson base substrate is available. Ships: fail-closed Postgres RLS (FORCE-enabled, cross-tenant isolation CI-tested), per-tenant AES-256-GCM field encryption (HKDF-SHA256 key derivation, one key per tenant), an append-only SHA-256 audit chain via kernel verifyChain, auth and billing primitives, and the create-caisson generator. Start with bunx @caisson-sh/cli@latest. https://caisson.sh/updates#field-crypto-v0-2 https://caisson.sh/updates#field-crypto-v0-2 Wed, 10 Jun 2026 00:00:00 GMT field-crypto ships as part of the base substrate. Per-tenant encryption keys derived via HKDF-SHA256, AES-256-GCM authenticated encryption, and a key-derivation layer that scopes each tenant's key material to their row context. No plaintext key material in the application layer. Covers HIPAA §164.312(a)(2)(iv) (encryption and decryption). https://caisson.sh/updates#kernel-registry-v0-1 https://caisson.sh/updates#kernel-registry-v0-1 Fri, 15 May 2026 00:00:00 GMT The Caisson kernel and registry runtime are available. The kernel provides verifyChain (append-only SHA-256 audit chain), tenant context primitives, and fail-closed RLS helpers. The registry exposes typed module definitions for every bundle. Fail-closed Postgres RLS (FORCE-enabled, cross-tenant isolation tested in CI) is available in the base substrate.