Changelog

Webhook delivery now includes automatic retry with exponential backoff for failed deliveries. Each webhook event is tracked from dispatch through confirmed receipt. Events that exhaust retries are moved to a dead-letter queue, visible in the admin portal, where they can be reviewed and replayed. Delivery status and latency metrics are available in the observability dashboard. Webhook signing uses RS256-signed payloads so receiving endpoints can verify authenticity without shared secrets.

The Arbitex authorization server now supports PKCE (Proof Key for Code Exchange) for browser-based and native mobile applications. PKCE prevents authorization code interception without requiring a client secret — making it the appropriate flow for public clients including admin portal extensions and internal tooling. The PKCE flow is enabled by default for all new OAuth application registrations. Existing confidential client integrations are unaffected.

A healthcare compliance reference package is now available for organizations deploying Arbitex Gateway in clinical and administrative environments. The package covers PHI detection coverage across all 18 HIPAA identifier categories — including DEA registrant numbers, NPI provider codes, Medical Record Numbers, and Medicare Beneficiary Identifiers — with mapping to 45 CFR §164 safeguard requirements. Includes sample HIPAA compliance bundle configuration, audit log retention setup for six-year record-keeping, and BAA process documentation. Available on request from your account team.

Hybrid Outpost software updates now ship with cryptographic signatures on all bundle artifacts. Each release package includes a detached signature and integrity manifest that allows air-gapped environments to verify update authenticity before installation — without contacting external package registries. Verification tooling is bundled with the Outpost installer. Signature verification is enforced by default in production deployments; existing deployments receive a migration guide with the next update.

Users can now upload, crop, and preview a profile photo directly from the account settings panel. The upload flow accepts common image formats, applies automatic resizing, and shows a live preview before saving. Photos appear in the chat interface and conversation sidebar alongside messages. When no photo is uploaded, the interface continues to display a colored initials badge. Administrators can manage avatar uploads and enforce organization-level avatar policies from the user management panel.

Arbitex Gateway now runs a structured smoke test suite on every startup and policy reload. Tests validate DLP pipeline availability, provider connectivity, audit log write access, and policy engine initialization before the gateway begins accepting traffic. If any critical check fails, the gateway enters a safe-hold state and surfaces the failure in the health dashboard. Smoke test results are available via the admin API for integration with external monitoring and deployment pipelines.

A structured documentation package is now available for organizations conducting Model Risk Management reviews of AI gateway deployments. The package covers gateway architecture, DLP pipeline design and validation methodology, policy change management controls, and audit log tamper-evidence properties. Formatted for use in OCC SR 11-7 and Federal Reserve SR 11-7 model validation submissions. Available on request from your account team.

A preview page for the Voya Financial compliance collateral package is now available at arbitex.ai/industries/financial-services. The page covers the AI model boundary enforcement architecture, GLBA and SOX compliance bundle configuration, and the tamper-proof audit log design — with specific reference to financial services examination requirements. The full compliance summary package, including SEC Reg FD and BSA/AML chain-of-custody documentation, is available on request.

The Arbitex admin portal now generates a title for every AI conversation automatically. Titles are derived from the opening messages using the configured language model, with a word-boundary fallback that activates when the LLM is unavailable. Existing conversations without titles are backfilled on upgrade. Auto-titling can be enabled or disabled per deployment from the admin configuration panel, with a configurable model selection for title generation.

Users can now upload a profile photo that appears in the chat interface alongside their messages. Photos are automatically resized and stored. When no photo is uploaded, the interface displays a colored initials badge derived from the user's name — so every conversation has a consistent visual identity for each participant. Administrators can manage avatar uploads through the user management panel.

The conversation list in the admin portal now shows the primary model used in each conversation, with a badge indicating how many models were active in multi-model sessions. This makes it easy to review which AI providers are handling which workflows at a glance — useful for compliance reviews, cost attribution, and operational monitoring.

The admin portal has been updated to meet WCAG 2.1 AA accessibility standards across all pages. Updates include skip-to-content navigation for keyboard users, ARIA roles and labels on modals and tables, aria-current indicators on active navigation items, accessible form labeling throughout audit log and DLP rule management, and focus management on modal open and close. Screen reader and keyboard-only navigation flows are fully supported.

The webhook management view in the admin portal now surfaces delivery status and error details for each attempt. When a webhook delivery fails, the error message appears in the delivery log with the full text accessible on hover. Delivery log entries can be searched and filtered by status (pending, delivered, retrying, failed, dead-letter). Failed deliveries can be manually retried from the dashboard.

Hybrid Outpost reliability is backed by an expanded integration and end-to-end test suite. The air-gap test suite validates local audit queue persistence, circuit breaker behavior during offline operation, and sync-on-reconnect semantics. Certificate rotation tests cover chain verification, atomic file write, and fail-open behavior on network or chain errors. Admin CLI coverage validates status schema, exit codes, flag handling, and error edge cases.

We completed a structured platform audit across seven functional dimensions: copy and voice accuracy, WCAG 2.1 AA accessibility, browser compatibility, performance, SEO, link integrity, and dependency security. 79 findings were identified and triaged by severity. All critical and high findings are resolved. Dependency audit: zero vulnerabilities in production scope. The audit methodology — MECE categorization, severity stratification, and complete closure (not mitigation) — is described in the engineering blog.