TracCloud: Release Notes for 2026-07

Release Notes — Nicolas Corder

Cycle: post-1.3.37 → 1.4.x (TracCloud) · Trac Engine develop · June–July 2026

TracCloud (application layer)

Event & Observability Platform (headline work)

• Built out a first-class telemetry system so every meaningful action in the app emits a structured, auditable event.
• New app-namespaced event-source taxonomy and a fleshed-out event() API, adopted across the app procs, helpers, and the src/App domain layer.
• Audit telemetry now covers logins and sensitive user actions end to end.
• Delivery upgraded to the latest AWS EventBridge features, with the ability to buffer events through SQS / Beanstalk for throughput and reliability under load.
• Navigate360 (EAB) integration: new Navigate360 API client, wired to the eab_visit_export cron for automated visit export.

Security & Compliance

• Credential redaction across traces/telemetry via PHP #[\SensitiveParameter] — secrets no longer leak into logs or error reporting.
• Resolved third-party licensing issues (password-strength manager) and fixed the license-scan CI job cloning an incomplete project.

Performance — Caching

• Asset-serving endpoints now send proper Cache-Control (the proc_cache_headers work) so QR codes, campus logos, resource images, photos, and reference PDFs are cacheable at appropriate public/private TTLs.
• More aggressive file caching for reusable static content.

Platform — PHP 8.5 Upgrade

• Moved deployments to PHP 8.5; cleared deprecation-driven build failures (case-statement semicolons, $http_response_header, nullable types, tracLoadForm false/array handling). Docs updated to match.

Documentation

• Introduced LLM-assisted documentation generation and synced the doc corpus, including a consolidated security-findings summary.

Trac Engine (core framework — submodule)

Logging & Telemetry Infrastructure

• New buffered Valkey log driver: pipelined XADD, shared TLS connection with token-refresh on AUTH failure, MAXLEN ~500k trimming, and drop-on-failure safety so logging never blocks a request.
• App logs buffered and flushed in a single XADD after fastcgi_finish_request (zero added request latency).
• Non-blocking CloudWatch event logging via async putLogEvents with a shutdown settle; EventBus/EventBridge client reused per request on the direct path.
• Repaired CloudWatch stream recovery and added request-log redaction.

Event System Core

• Completed the engine-side event system: expanded event taxonomy with new domain enums, actor() helper, Event::toEnvelope(), and a RedisBuffer enqueue path (with surfaced connect/read-timeout failures).
• EventBridge client + event functions, cron events, campus-code enrichment, and environment-scoped EventBridge source names.

Rate Limiting

• New Rate Limiter module with an EventBridge event on the rate-limit handler.

Microsoft Graph Integration

• Delegated /me email + calendar sending via a SwiftMailer transport (feature-toggle gated).

Security

• Path-traversal fix in emailTemp asset serving.
• Credential redaction via SensitiveParameter; security library updates.

Reliability & Compatibility

• Event buffering to Beanstalk/SQS for throughput.
• URL versioning toggle for pushResource (cache-busting control); PHP nullable-deprecation cleanups.