Releases
Changelog
A running history of Flowcerta platform changes, parser coverage updates, rule additions, and customer-visible release notes.
- Flowcerta CLI: install with npx @flowcerta/cli, and gate a workflow from inside the loop a coding agent already works in. flowcerta gate <file> exits 0 when nothing breaches, 1 on a policy violation, and 2 when the tool could not answer, so an agent can tell "fix your workflow" from "the check did not run". UiPath's own published exit-code contract does not make that distinction. Analysis runs locally; workflow files never leave the machine.
- Diff-aware gating: a workflow tracked in git is judged against its committed version, so an agent is blocked by what it introduced rather than by debt it inherited. Untracked files are judged whole, because all of it is new.
- Your organisation's rules reach the CLI. GET /api/v1/agent/policy serves the effective rule config to a signed-in machine, cached for fifteen minutes and merged as a floor: a project may tighten a rule but never loosen one, and a per-rule overridable flag decides which rules a project may relax at all. Sign in from a terminal with flowcerta login, which opens a browser by device code and works on a machine with no browser attached (Migration 058).
- Agent guardrails: say once what your coding agents may not do, and flowcerta guardrails --apply compiles it into whatever permission file each agent actually reads, across Claude Code, Cursor, Codex and Gemini CLI. Anything a format cannot express is printed rather than dropped, so a repository is never reported as governed with a hole in it. flowcerta guardrails --check exits 1 in CI when a checkout drifts.
- Agent provenance: find out which of your automations a coding agent wrote, and whether they fail policy more often. Opt-in per organisation and off by default. Rule IDs and severities travel; a finding's description, a file path and the workflow itself never do. Verdicts that name no agent are reported as unattributed rather than as human-written, because the absence of a signal is not evidence about a person (Migrations 059, 060).
- The fix cycle, which only a tool inside the loop can see: how many attempts an agent takes to get a workflow through the gate, and how often a run stops without ever going green. A platform that sees only the merged result sees one commit, and cannot tell whether it took one try or nine.
- Production outcomes: provenance joins to the workflow inventory, so the question moves from "do agent-written automations break policy more" to "are they live in production carrying more regressions". Reported as associations rather than causes, alongside the count of workflows that actually matched, because a file name is not a stable identifier.
- Retention you set, bounded by your plan: choose how long gate verdicts are kept, capped per tier, with the cap applied when the nightly purge runs rather than when the number is saved. A plan change takes effect without anything having to rewrite it.
- flowcerta context orients an agent in one call, covering the project, the rules in force, sign-in, guardrails and what to run next. The flowcerta-govern skill teaches any agent that reads the Agent Skills format how to use all of it.
- Custom rule authoring. Author org-scoped UiPath risk rules from a dashboard editor: activity and property conditions, or a composable match.where tree (boolean allOf/anyOf/not, structural notInsideAncestor / siblingBefore / siblingAfter, child-element matching), with a live dry-run against an uploaded .xaml. Rules fire for every member and every CI run.
- Community rule packs: import and export rule packs as YAML with a preview-then-apply additive merge, import offline from the CLI with rpagov rules import, and browse a curated in-app catalog that drops a pack straight into the import preview.
- Orchestrator scan-on-publish and regression alerts: connect UiPath Orchestrator to scan each newly-published package version automatically and post a workflow.score_regressed webhook to Slack or Teams when a version drops a score band or adds a Critical/High finding. Opt-in per connection (Migration 046).
- Orchestrator governance status: each connection lists its synced processes with a health band and a regression flag drawn from the workflow inventory.
- SBOM export: GET /api/v1/inventory/sbom returns an automation SBOM in JSON or SPDX 2.3, covering invocations, queues, credential references, observed endpoints, and package versions.
- Compliance intent pages: new /for/sox-compliance-automation, /for/hipaa-rpa-governance, /for/gdpr-rpa-governance, and /for/pci-dss-automation-governance landing pages.
- Public compliance mapping: /compliance maps each governance rule to SOC 2, HIPAA, GDPR, NIST 800-53, ISO 27001, and PCI DSS controls, and the OpenAPI spec is published at /api-docs/openapi.json.
- Audit evidence packs: export a signed (HMAC-SHA256) audit pack per org or per validation as JSON or PDF, with portfolio stats, findings, applied policy, and framework coverage; download buttons on the portfolio and validation views.
- Outbound webhooks: org-level HMAC-signed webhooks fan out validation.completed, validation.below_threshold, and exception.expiring_soon to generic, Slack, or Teams endpoints, managed from a Webhooks tab.
- Cross-workflow severity: upload a whole project (.nupkg/.zip) for a dependency graph and blast-radius ranking; a finding in a workflow invoked by many others is elevated by caller count.
- Power Automate expansion. Six new detectors (PA-005..PA-010): hardcoded endpoints, empty scopes, tight recurrence triggers, unfiltered event triggers, variable initialization inside loops, and high-concurrency loops.
- In-house nurture engine: event-triggered email sequences (post-scan, signup, org-created, re-engagement) with HMAC unsubscribe links, sent over the existing notification transport (Migration 040).
- CoE starter policy packs and comparison surfaces: three published starter policy packs, three /vs/ comparison pages, and a /security-and-procurement page with a pilot form.
- Growth plan unlimited users: the 10-user cap on the Growth tier was removed.
- Workflow Review unified routing: every operator entry point (upload handoff, validation banners, findings, overview hotspots, portfolio drilldowns, compliance per-control workflows) now routes into the same Workflow Review queue.
- Power Automate analyzer expansion. Three new detectors landed: PA-002 (hardcoded credentials in action inputs), PA-003 (HTTP actions with retries disabled), PA-004 (unbounded Do Until loops).
- Free scanner email gate: anonymous /scan results now show top findings free and gate the rest behind an email submit. Every scan produces a shareable read-only report URL.
- CI smoke test: Playwright app-shell smoke now runs on every pull request, with chromium auto-installed in CI.
- Inventory operations: per-row validation history drawer, regression count stat card, and a tunable stale-threshold and needs-review score per org.
- Validation feed signals: non-regression diffs, blocking-finding markers, applied policy summary (overridden and exempted rule IDs), and inline rule playbook links.
- Ingest diagnostics: recent failed ingest jobs surface on the validations page; GET /api/v1/jobs/{id} returns the failure reason.
- UiPath crosswalk reconciliation: every UiPath 2024.10 rule classified against the catalog; reconciliation report surfaces name drift between the catalog and upstream.
- Two new UiPath detectors: FC-UIP-PMG-001 (duplicate activity IDs) and FC-UIP-ARG-003 (undefined output property).
- Empty states clarified: every dashboard page explains what the empty state means in context rather than rendering a bare placeholder.
- Live UiPath rule refresh tool: refreshes the published rule docs from upstream on a seven-day cache.
- Pipeline context preservation: validation records now keep repository, branch, commit, run, and Power Platform deployment context end to end (Migration 036).
- Weekly digest composer and scheduler: opt-in weekly summary emails for governance activity.
- Orchestrator connections scaffolding: opt-in connector slot for UiPath Orchestrator and AA Control Room (Migration 034 foundation for proactive scan-on-publish).
- Detector explainability: every RiskFlag carries SourceXPath and SourceLineNumber so "why did this fire?" lands at the source.
- CLI explain subcommand: debug rule decisions with full provenance and detector narratives.
- GitHub Actions annotations: CLI emits inline GitHub Actions annotations for findings in CI logs.
- Validation source provenance: the dashboard shows where each validation was submitted from (CI, manual upload, API key).
- Bundled rule catalog: the dashboard reads rule metadata from a generated catalog so toggles, playbooks, and policy packs stay in sync.
- Validation ownership: assign a named owner to any validation result from the detail view.
- Finding dispositions: mark findings as Will Fix, Acknowledge, or Request Exception without leaving the results view.
- Risk exception approval workflow: managers can approve or reject exceptions with a written rejection reason captured in the record.
- Regression detection: change impact diff now surfaces severity changes and waiver changes across repeat validations of the same workflow.
- Policy pack environment profiles: configure per-environment rule overrides (dev/test/prod) without hand-editing JSON.
- Validation evidence export: copy a handoff-ready evidence summary from any validation detail for audit and review use.
- CI/CD source filtering: filter the Validations feed by source to see only pipeline-submitted runs.
- Validation finding actions: link directly from a finding to the published rule playbook and re-validation shortcut.
- Compliance mapping pipeline: each finding now maps to applicable controls in ISO 27001, SOC 2 Type II, GDPR, and NIST CSF.
- Rule playbook links: findings for seeded rules link directly to published remediation guidance.
- Team collaboration: assign reviewers, track approval state, and view org-scoped review history on Pro and Enterprise plans.
- Policy pack rule management: custom rulesets with per-rule severity, enforcement mode, and exemption controls.
- Validation API: POST /api/v1/validate accepts multipart workflow files and returns a structured score, findings, and blocking status.
- GitHub Actions integration: drop-in CI step with enforcement_mode=blocking support.
- Azure DevOps support: CmdLine@2 task example with Build.DefinitionName and Build.BuildNumber pipeline labels.
- API key management: create and revoke keys with scoped permissions from the Team panel.