Feature status

October 31 SDK publication: Go SDK 3.17.0 and Ruby SDK 3.17.0 are publicly available through the Go module proxy and RubyGems. Independent clean consumers verify both installed packages, OpenAPI 18.4.0 and 915 operations. Publishing these clients does not establish hosted API availability or native framework/local-runner parity.

October 29 source candidate: public NLWeb /ask adds bounded, rate-limited anonymous documentation search and v0.55 streaming; supplied credentials still require docs:read. Docs MCP adds typed listing pagination. OpenAPI 18.3.0 and regenerated client source describe these changes; exact deployed acceptance is pending. ChatGPT directory publication remains pending. No public hosted sandbox or postal address is added.

EvalGate’s hosted platform is Beta. Start with the credential-free TypeScript local gate, then break a case and verify exit 2. A passing gate means only that its configured checks passed.

Status	Meaning
Shipped	Released supported workflow with recorded acceptance evidence. It does not imply an SLA or certification.
Beta	Available hosted product; support and procurement commitments require an explicit agreement.
Experimental	Available or source implemented with the interface or named workflow acceptance still incomplete. Read the evidence column.
Planned	Unavailable. Publishing a client does not enable the service.

What you can use today

The table owns availability. Source merges, package versions and historical qualification notes below do not override it. 3.17.0 application and 3.17.0 SDK identify this source line; the published TypeScript/Python 3.15.0 archives remain immutable. Candidate hard budgets, cost approval, scoring v2 and JUnit changes require their own release acceptance.

Feature	Status	UI entry point	Public REST / OpenAPI operations	SDK and CLI	Verification evidence	Owner
API assertion test mode	Experimental	Public assertion executor at `/api/demo/custom-eval`	Candidate `getAssertionTestMode` and `runAssertionTestMode`	Generated TypeScript/Python clients and generic `evalgate api`; requires a client release containing the operation IDs	Bounded stateless assertion contract; source tests and exact deployed GET/POST acceptance are separate; no hosted CRUD sandbox	Developer Experience
Evidence workspace preview	Experimental	Optional trace, evaluation, knowledge, review, analytics and administration presentation	Canonical trace tool evidence, reviewer-bound Arena preference and revision-bound discussion contracts; existing product mutations remain authoritative	Generated TypeScript/Python and generic CLI operations; no new model or release authority from presentation	October 27 source candidate reconciles the 54-pattern research shortlist. Default-off build-time rollout; local regression evidence and exact deployed acceptance are separate. Historical availability, named integrations and model qualification are not implied	Product Experience
Connections experience	Experimental	`/connections`, Settings → AI providers and Setup	Canonical accounts, reviewed lifecycle and native source discovery/grant/operation contracts	Shared REST and generated TypeScript/Python/CLI contracts; released MCP reads retain their separate boundary	October 22 source candidate implements the 23 former Coming soon connectors with explicit operation/format limits. Named-account authorization, configured credential storage, migration and exact-deployment acceptance remain required; saving a setup does not prove access.	Integrations
Portable quality for non-repository work	Planned	Unshipped candidate source adds `/quality`; the released application does not expose it	Candidate source implements authenticated context/revision/resource upload and query, canonical checks, grounded corrections, explicitly approved standards, later-task standard reuse, grants, delivery, and lifecycle routes. Production defaults fail closed behind independent capture, ingestion, check, background, learning, and host flags; evidence reads and safety controls remain available during rollback	TypeScript/Python clients and CLIs are packaged in SDK 3.13.1 with clean-install registry proof, including resumable upload and credential-free no-repository local mode. Candidate MCP adds eleven exact-scope tools, including approved-standard plan creation, canonical-result evidence, and evidence attestation for checks waiting on evidence. Public Skills route portable artifacts capability-first. SDK publication does not establish deployment of the corresponding cloud API, web or MCP surfaces	Local proof covers additive migrations, tenant/ACL denial, durable Postgres/Redis jobs, worker-produced failed/pass canonical runs, service-level correction → approval → later-task reuse, packaged Node 24 parser/query/check workers, worker kill/restart, 3,000,000-row CSV, multi-sheet XLSX semantics, scoped learning, cross-host protocol fixtures, OpenAPI/SDK parity, installed packages, MCP protocol, and feature-off API/worker controls. Seeded authenticated browser acceptance, public-route composition proof, named hosts, live providers, and exact application deployment remain open under DISC-20261003-001 and the Portable Quality discovery entries	Platform Foundations
Credential-free cloud-agent local gate	Experimental	None; repository CLI execution	None; local execution deliberately creates no hosted identity	TypeScript and Python CLIs in `@evalgate/sdk@3.15.0` / `evalgate-sdk==3.15.0` expose `evalgate init --local`, `baseline update`, `status --json` (and `--format json`), and `gate --format json`; JSON/non-TTY init requires explicit `--apply`. Each CLI evaluates only its own runtime’s specs, so a Node project is not runnable by the Python CLI and the reverse also holds. No REST surface.	Packed-candidate cold start (no auth, no remote, network denied, path with spaces) and a real published-3.8.2→candidate upgrade both pass and fail closed (`pnpm agent-experience:cold-start`, `pnpm agent-experience:upgrade`); zero network attempts counted with the guard proving activation. TypeScript/Python parity is NOT complete — see DISC-20260903-003 remaining items 1–2. PyPI remains separately governed; exact-head CI	Developer Experience
GitHub repository access and Repository Intelligence	Experimental	`/setup` → Connect a GitHub repository, then `/repository-intelligence`	`get_integrations_github`, `post_integrations_github`, activation preview/apply, and the repository list/scan/ask operations	Generated TypeScript, Python, and CLI REST contracts. `@evalgate/sdk` (3.12 line) separates durable link identity from exact-commit activation snapshots, reports commit relationships without unlinking, and adds matching `login`, `whoami`, `link`, `status`, `open`, and `logout`; 3.12.3 adds recoverable App user-OAuth for install claims	Commit-graph service/route tests, DOM, workspace DOM, Unit, PostgreSQL, and focused TypeScript/Python CLI source tests; live device flow, App installation, private-repository scan/Copilot, exact-head CI, and production browser proof remain open	Integrations
Playground	Shipped	`/playgrounds`, then `/evaluations/{id}/playground`	`get_playgrounds`, `get/post/patch_evaluations_id_playground`, plus documented winner, variant, scorer, run, proposal, case, assistant, cancellation, and export operations	No dedicated client methods; use REST	API and persistence tests; exact-head CI	Evaluation Workflows
Prompt Hub	Shipped	`/prompts` and an evaluation detail page	`get_prompts` and the evaluation prompt/version operation family	CLI sync supports prompt pull/push; no complete convenience-client surface	Prompt route tests; exact-head CI	Evaluation Workflows
Scorer Studio	Shipped	Measurement → Scorers (`/measurement?view=scorers`; `/scorers` redirects) and `/scorers/{scorerId}`	`/api/scorers` plus version, example, test, alignment, calibration, publish, binding, and usage operations	No dedicated SDK or CLI; use the authenticated REST workflow	Scorer workflow proof and hostile-code OCI boundary proof; exact-head CI	Evaluation Workflows
Red-Team Workbench	Shipped	`/red-team`	`/api/red-team` risk-pack, campaign, run, release-evidence, finding, remediation, and signed-report operations	SDK 3.13.1 includes generated TypeScript and Python clients plus CLI commands: `evalgate red-team evidence --run <run-id>` compiles, verifies, and atomically persists exact-run evidence; `evalgate red-team finding --finding <finding-id>` reads persisted source states and commit-pinned graph/locator evidence. Strict gates pin organization, campaign scope, target, and trust anchor; campaign orchestration remains an explicit REST workflow	Red-team workflow, durable compiler, route, TS/Python CLI and failure taxonomy, persisted finding-to-source DB/API/DOM proof, and gate test source pass locally; exact-head CI passed for the SDK 3.13.1 source; corresponding production deployment and live-provider qualification remain separate requirements	Evaluation Workflows
Logs & Trace Explorer	Shipped	Evidence → Logs (`/evidence?lens=logs`; `/logs` redirects)	`/api/logs` query, detail continuation, aggregate, saved-view, cohort, bulk-action, and audited-export operations	No dedicated TypeScript, Python, or CLI convenience workflow; use authenticated REST	Unit, API, database, DOM, and golden-path proof source; exact-head CI	Production Intelligence
EvalGate Copilot	Experimental	`/copilot` and supported product surfaces	`/api/copilot` thread, retained-context, message, action, proposal, accept/apply, and reject operations. An action turn may run bounded, read-only dataset queries (search, count, rows, run outcomes; at most 50 rows per call, 8 calls per turn) and returns each with its scope and row citations; semantic search answers unsupported. Proposals may create a new draft dataset or evaluation, applied only on acceptance	No dedicated SDK or CLI convenience workflow; use authenticated REST and the review UI	Unit, API, database, DOM, and golden-path proof source; exact-head CI. Dataset tools and creation proposals: organization-isolation and apply-path DB tests and query-scope DOM test on the readiness branch; no released-availability claim	Evaluation Workflows
Remote Runners	Shipped	`/remote-runners`	`/api/remote-runners` registration, credentials, lifecycle, enqueue, claim, heartbeat, stream, cancellation, lease recovery, completion, and reconciliation operations	TypeScript and Python worker SDKs implement the signed protocol. SDK 3.13.1 includes experimental `evalgate serve`, which runs a customer command per case and registers executable targets (`/api/remote-runners/targets`); use requires a matching deployed server contract	Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI	Evaluation Runtime
Deployable Assets	Shipped	Releases → Deployment (`/releases?view=assets`; `/deployable-assets` redirects)	`/api/deployable-assets` list/create, approval, transition, rollout, health, and governed invocation operations	Generated contract types only; no complete TypeScript, Python, or CLI deployment client	Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI	Evaluation Runtime
Trajectory Analysis	Shipped	Evidence → Trajectories (`/evidence?lens=trajectories`; `/trajectory-analysis` redirects)	`/api/trajectory-analysis` ingestion, detail, scoring, comparison, report, and retention operations	TypeScript and Python clients cover ingestion, inspection, scoring, reporting, and comparison; no dedicated CLI command	Unit, API, PostgreSQL, DOM, and golden-path proof sources; exact-head CI	Evaluation Quality
Dashboards and monitors	Shipped	`/dashboards` and pinned `/dashboards/shared/{token}` views	Metric-definition, metric-query, dashboard/version/widget/render/share, and stateful alert/event/delivery operation families	No complete TypeScript, Python, or CLI convenience workflow; use the authenticated REST contract	Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI	Evidence & Reporting
Failure patterns	Shipped	`/insights` (UI title: Failure patterns; API resource family remains failure-topics)	Topic discovery/detail/version controls, merge/split, Gateway label proposals, and governed corrective actions framed as named failure patterns with why-it-matters and next-state cues	No dedicated TypeScript, Python, or CLI convenience workflow; use authenticated REST	Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI; UX compression investigation framing on main	Production Intelligence
Dataset Hub	Shipped	`/datasets`	`/api/datasets` dataset, row, import, trace-conversion, health, version-lifecycle, and diff operations plus evaluation dataset bindings and run dataset snapshots	TypeScript `client.datasets` and Python `DatasetHubAPI`; TypeScript and Python CLI `evalgate datasets` list/create/import/version/publish/bind	Dataset Hub route tests; exact-head CI	Evaluation Workflows
Experiments	Shipped	`/experiments`, plus Promote from Playground	`get_experiments`, `post_experiments`, run/cancel/progress/results/compare/decision/publish-winner operations, and `post_evaluations_id_playground_promote_to_experiment`	No dedicated TypeScript, Python, or CLI Experiment client; use authenticated REST or `evalgate api`	Experiment route tests; exact-head CI	Evaluation Runtime
Continuous Eval Studio	Shipped	`/online-evals` and `/online-evals/{monitorId}` for draft, simulation, activation, operation, and remediation	Monitor/version CRUD, simulate/activate, pause/resume, bounded backfill/cancel/resume, sample/run/health/topic/candidate reads, alert delivery, and verified remediation operations under `/api/online-evals/*`	No dedicated TypeScript, Python, or CLI monitor workflow; use authenticated REST	Unit, API, PostgreSQL lifecycle, DOM, and golden-path proof source; exact-head CI	Evaluation Runtime
Review Queue	Shipped	`/review`	`get_evaluations_id_human_review`, `post_evaluations_id_human_review`, `post_evaluations_id_human_review_reviews`	CLI review supports local/gate workflows; no complete queue client	Review route tests; exact-head CI	Trust & Review
Synthetic and golden lifecycle	Shipped	Releases → Candidates (`/releases?view=candidates`; `/candidates` redirects) and evaluation Synthesize/Test Cases panels	`get_candidates`, `get_candidates_id`, `patch_candidates_id`, `post_candidates_id_replay`, `post_candidates_id_promote`, and evaluation-scoped review/promotion operations	CLI `synthesize`, `promote`, and `replay`; TypeScript and Python canonical golden-case support	Promotion DB tests; exact-head CI	Trust & Review
Model Gateway	Shipped	Settings → AI providers (`/settings/connections`)	`get/post_model_gateway_configs`, config detail/health/rotation, routing-profile, model-sync, call-ledger, and test-call operations	No dedicated generated gateway client or CLI	Gateway ledger DB tests; exact-head CI	Gateway & Providers
Evals-as-Code	Shipped	CLI/CI first; evaluation pages show applied results	`post_evals_as_code_validate`, `post_evals_as_code_plan`, `post_evals_as_code_diff`, `post_evals_as_code_apply`, `post_evals_as_code_gate`, manifest/apply/drift operations	TypeScript CLI is the primary client; Python parity remains incomplete	Rollback and drift DB tests; exact-head CI	Developer Experience
MCP review surface	Experimental	`/api/mcp` for coding/chat agents, public `/api/mcp/docs` for reviewed product documentation; legacy `/api/mcp/tools` remains documented separately	Released inventory: stateless MCP `2026-07-28`, public protocol and released read-only schema/resource discovery, authenticated scope- and role-filtered calls, eight read-only P0 review tools, a scoped run-evidence MCP App, stateless 2025 initialization fallback, and a separate anonymous docs server. Connection-management and eleven Portable Quality MCP implementations are not publicly enabled; the generated release boundary below controls discovery and direct calls	RFC 9728 metadata links to first-party RFC 8414 authorization-code/PKCE and RFC 8628 device flows. Public clients use exact registered redirects; a signed-in person chooses the organization and scopes before EvalGate issues a revocable 90-day API-key token. No refresh token or production-like sandbox is offered	Released surface: source conformance, schema parity, PKCE validation, App-resource, and public-docs isolation tests. Candidate Portable Quality MCP: 26 protocol tests plus 1,356 route/scope checks; no exact deployment or named-client claim. Status remains experimental until migration, exact deployment, and the real-client compatibility matrix pass; exact-head CI	Agent Native Surfaces
Agent Skills distribution	Experimental	`npx skills add evalgate/skills`, the public `evalgate/skills` repository, and `/.well-known/agent-skills/`	One primary `evaluate-ai-change` decision framework plus five focused setup, gate, trace, repository, and MCP Skills; progressive references cover behavioral impact, authoring, regressions, experiments, cost, evidence, invalid runs, and the canonical nine-value decision contract with required quality, protected-slice, reliability, latency, and cost reporting	Skills invoke documented CLI/API/MCP contracts but do not enforce policy, grant credentials, expose private scoring logic, or make an unevaluated release safe	Pinned `skills` CLI discovery and selected-install proof for Codex, Cursor, GitHub Copilot, OpenCode, and Zed; eleven provider-neutral decision scenarios cover every classification and release decision, including a mixed bug sweep that scores decision correctness separately from reporting completeness. Default-branch promotion, hosted CI, broader multi-model trials, and skills.sh re-indexing remain pending; exact-head CI	Agent Native Surfaces
Provider onboarding	Experimental	Connections → Add a connection; provider-key setup is temporarily unavailable in the hosted application while credential storage is restored	Provider-key REST plus Model Gateway config, health-check, model-sync, and test-call operations; configured storage and provider authorization are prerequisites	Generated contract types only; no dedicated onboarding convenience client or CLI	Local DOM/browser fixtures do not prove production credential storage; hosted setup remains under release qualification	Gateway & Providers
Infisical vault-linked provider keys	Experimental	Connections → Secret managers; depends on the same hosted credential storage as provider keys	`/api/org/credential-vaults/infisical` connect, list secret names, link, check, unlink and disconnect; direct providers only (OpenAI, Anthropic, Google, xAI, Moonshot)	Generated contract operations and `evalgate api`; no dedicated convenience client	Real-database tests with a simulated Infisical server; no live Infisical Cloud or production acceptance yet; Model Gateway credentials and self-hosted Infisical unsupported	Gateway & Providers
Calibration control plane	Shipped	Measurement → Calibration (`/measurement?view=calibration`; `/calibration` redirects), plus evaluation-detail and Measurement → Judges workflows	Anchor-set/version/review, mapping/review/diff/drift, workspace, release-gate, scorer-binding, and existing evaluation calibration-proposal operation families	Judge execution exists in both SDKs; no complete SDK or CLI control-plane workflow	Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI	Trust & Review
Evaluator measurement integrity	Shipped	`/evaluator-validation` measurement workspace, plus run summaries through existing evaluation APIs	Release/run lifecycle, coverage-aware policy sampling, automatic post-run validation, delayed outcome attribution/recomputation, canonical AB/BA judge execution, interval-bearing causal metrics, observation execution, metric reads, and measurement-bound release/Evals-as-Code gates	TypeScript and Python SDK measurement clients, including delayed outcomes; `evalgate measurement` lists releases/runs, inspects metrics, and executes validation runs	Measurement API and database tests; production browser proof remains release-gated; exact-head CI	Evaluation Quality
Golden Release / AI regression bot	Experimental	Releases → Golden gate (`/releases?view=golden`; `/golden-release` redirects) candidate inbox, decision header, and publication panel (flag-gated)	Sealed OTEL revisions, canonical measurement revisions, GitHub App webhook/publication/check APIs behind `EVALGATE_*` flags	No dedicated generated SDK convenience client yet; composite Action and sticky comment remain supported	Golden Release vertical proof; sandbox GitHub App and production browser proof outstanding; exact-head CI	Evaluation Quality
Governed Full-Harness Improvement Loop	Experimental	`/improvement`	Organization-scoped `/api/improvement` reads (cycle list/detail, hypotheses, candidates, candidate diff, attempts, partitions, events, scenarios, runs) and governed writes: start and cancel a sandbox run, compile and approve an Optimization Contract for the next run, authorize, and adopt	Generated TypeScript and Python operations; `evalgate improve` covers cycles, inspect, run, watch and adopt. Contract approval and adoption under a contract require a person signed in; API keys and MCP tokens are refused. Shadow, canary, promote and rollback are not client actions	Real-execution proof (17 tests spawning real child processes), non-prompt acceptance scenario (15 tests, 120 real executions), mutation adapters, statistical decision rules, and learning compilers, OpenRouter model broker (22 tests against a real loopback HTTP server), and comparison statistics, cross-organization isolation, CLI, and workspace DOM. No released-availability claim: no exact-head CI run, no browser proof, and no live-model or live-traffic evidence is claimed. A real OpenRouter adapter exists and is proven against a loopback HTTP server, but no run against a live model has been performed: this environment’s network policy denies openrouter.ai. The default broker is a deterministic seeded behavioral model, not a language model. Scope and deferred items: ADR-009 and the operator reference	Platform Governance
Risks & controls	Experimental	`/proof/risks-and-controls`	Authenticated `/api/proof/risks-and-controls/*` for risks, controls, safeguard bindings, walkthroughs, assignments, evidence request/submit/review, conclusions, findings, risk acceptance, and reviewed-scope export. Reviewed profiles provide control-counted inventory, organization/system applicability and requirement references	Existing workflows use authenticated REST and Proof UI; discovery/profile operations are generated for TypeScript/Python and generic `api` CLI in source. Discover installed capabilities; source generation is not registry publication	Discovery and profiles are merged with exact-head CI, disposable native PostgreSQL and authenticated browser qualification. Production migration0258 and operational deployment readiness passed October17; the authenticated production control journey remains unverified. Unverified standards references and missing evidence grant no conformance, effectiveness or release authority; guest portals and collectors remain separate optional paths	Trust & Review
Reports	Shipped	Shared/signed evaluation reports from evaluation runs and Unified Eval Loop seal	`get_reports`, `post_reports`, verification operations under `/api/reports`	Generated contract types; CLI and UI share signed-report flows where documented	Reports verify route tests; exact-head CI	Evidence & Reporting
Asset Portability	Shipped	Releases → Portability (`/releases?view=portability`; `/portability` redirects) inventories prompt, dataset, calibration, scorer, failure_memory, approval, and institutional_context; evaluations, golden cases, red-team, deployments, experiments, and eval-loop workflows are omitted	`/api/portability` export/import for those seven kinds	Generated contract types only; no complete TypeScript, Python, or CLI convenience client	Portability DOM tests; exact-head CI	Developer Experience
Deployment	Shipped	CI and release workflow; no single deployment dashboard	`get_releases`, `post_releases`, plus Evals-as-Code gate/apply operations	TypeScript CLI and CI integrations are primary; Python parity remains incomplete	Golden path; exact-head CI	Developer Experience

API documentation publication boundary

API family	Status	Namespace
Portable quality	Planned	`/api/portable-quality`

The public API-page generator omits this namespace until its inventory status is Shipped. Legacy evaluation quality at /api/quality is a separate API.

Source candidates and release history

Source and release history

October 31, 2026 Go and Ruby SDK publication: Go SDK 3.17.0 is published as github.com/evalgate/evalgate-go/v3@v3.17.0, generated from OpenAPI 18.4.0 with 915 operations. Native HTTP/model tests, go vet, checksum database verification and an independent public-proxy consumer installation pass. Ruby SDK 3.17.0 is published as evalgate-sdk on RubyGems. Native HTTP tests, RBS validation, gem build and an independent credential-free public-registry installation pass. The downloaded gem matches the reviewed SDK-only artifact. SDK client source is distributed separately from the private application. Package release does not deploy corresponding cloud APIs or change the availability table above.October 21, 2026 enterprise identity candidate (PR763): organization-owned SAML/OIDC sign-in, verified domains, MFA policy and recovery are implemented in source against OpenAPI 13.9.0 and migrations 0262/0264. Live Okta/Entra and deployed enterprise acceptance remain pending; this is not a production-verified SSO availability claim. Identity changes are restricted to owners with an interactive session; authorized owner credentials can read the configuration. Generated TypeScript, Python and CLI operation contracts do not authorize API-key, saved CLI-session or OAuth mutations of identity settings. SCIM and SAML single logout are unsupported. See authentication for enforcement and credential-cutover behavior.October 28, 2026 release candidate (3.17.0): The candidate contains 3.17.0 application and 3.17.0 SDK source with generated clients for OpenAPI 18.2.0. It supersedes the unpublished 3.16.0 candidate and carries its changes, adds vault connections, the provider policy mode, blind Arena review, adjudication comments, trace tool-call evidence, validated UTC schedules and opt-in binary scan evidence and machine-payment agent top-ups, and clears every high and critical dependency advisory. Registry installation requires the sdk/v3.17.0 publication; the published 3.15.0 archives remain unchanged. The released inventory below is not promoted by this candidate note.October 26, 2026 release candidate (3.16.0, unpublished): The candidate contains 3.16.0 application and 3.16.0 SDK source with generated clients for OpenAPI 17.0.0. It reports unmeasured safety as unknown instead of passing, requires an accepted cost bound for Copilot actions and an idempotency key for automated adjudication, and upgrades production dependencies with critical and high advisories. Registry installation requires the sdk/v3.16.0 publication; the published 3.15.0 archives remain unchanged. The released inventory below is not promoted by this candidate note.October 21, 2026 source candidate (PR #764): The candidate contains 3.15.0 application and 3.15.0 SDK source. These versions do not identify the deployed application or upgrade existing published archives. The Ora follow-up implements first-party agent_auth service registration and human-approved claims, a local Docker API sandbox, generated Go/Ruby clients and managed outbound Web Bot Auth signing. It extends public authored Markdown coverage to 80 routes and updates MCP cards and NLWeb streaming. These source changes use OpenAPI 13.9.0; database, native package, sandbox and exact-deployment checks remain separate acceptance boundaries. Registry installation requires a verified package publication. No hosted public sandbox, third-party identity-assertion trust or incoming-bot verification is advertised. The released inventory below is not promoted by this candidate note.October 21, 2026 Go publication: The official Go SDK 3.15.0 is published as github.com/evalgate/evalgate-go/v3@v3.15.0. Native HTTP/model fixtures and a clean independent installation through the public Go module proxy pass. Its generated contract uses OpenAPI 13.9.0. Package publication does not deploy the corresponding cloud APIs; follow this inventory and the server’s advertised capabilities for endpoint availability. The Ruby SDK also passed native HTTP tests, RBS validation, gem build and clean local installation. At that time, RubyGems publication awaited account-owner trusted-publisher setup.October 21, 2026 TypeScript/Python publication: npm and PyPI both serve SDK 3.15.0, confirmed directly from their registry metadata. Package publication does not establish the deployed application identity or live third-party qualification. Integration adapters remain fixture-qualified. The OpenAPI 13.9.0 TypeScript/Python source changes in PR #764 require a new immutable release before registry installation can provide those newer contracts; the existing 3.15.0 archives must not be overwritten.October 18, 2026 release: 3.14.1 SDK is published as @evalgate/sdk@3.14.1 on npm and evalgate-sdk==3.14.1 on PyPI, from merge commit a02e835d416ac7afa0ee7b15841acd156ca6b082. All three registry archives match their original publisher files. Fresh external installs pass SDK imports, CLI versions and capability JSON checks; their lockfile and wheel download hashes bind to those verified originals. The npm tarball shasum is 5d5466e9868b65fe6b5a47d8e9f8c6d871c04d01; the PyPI wheel SHA-256 is 2943aa2f4e5d10f39124166f0f5b44a7f1c28c977c45c3e7123d3143a3e559fd. Both packages report OpenAPI contract 13.7.0, including the breaking 13.0.0 scan-enqueue response. Exact-source required lanes, coverage, the complete browser suite and SDK compatibility matrix passed before publication. The failed 3.14.0 tag remains preserved; 3.14.1 is the first published 3.14 release.3.14.1 application passed dated core-readiness checks at the same source on October 18 (04:58–05:08 UTC): canonical/provider HTTP, actual schema, database/Redis and the public browser surface agree. Selected database configuration and bounded worker connectivity are verified. Authenticated control journeys and the workload boundaries below remain open.Workflow availability remains separate: the October 17 maintenance applied the pending schema upgrade. The canonical site, provider instance, database, Redis and repository/general queue worker passed operational readiness checks. The authenticated control workflow still needs production journey verification; namespace-dependent workloads lack verified capable placement. Published client contracts do not establish that every cloud operation is available. Passing qualification does not certify live provider calls, every connector backend, external collector receipts or independent review/export workflows. Preserve the per-operation boundaries below. See release notes and the agent quickstart guide.Current follow-up candidate: scoped evidence assessment in the existing control-review form, a PostgreSQL external erasure ledger, restricted runtime database-role planning and asynchronous isolated table queries are under qualification. They require the matching application/worker deployment and additive schema where applicable. Local fixtures and generated source clients do not establish production availability or publish another SDK version.The current TypeScript line still includes the activation-compression workflow from 3.9.0 plus credential-free local start: device-flow login, whoami, remote-revoking logout, auto-detecting link, unified status, control-plane open, TTY-aware init, and init --local for sandboxes without account, browser, GitHub remote, or network. Durable organization/repository/root linkage remains stored in non-secret version 2 project context separately from the exact target SHA and immutable manifest of the last cloud activation. status derives local-gate readiness from the same preflight as gate and reports link, checkout, cloud snapshot, local-gate readiness, and cloud-target readiness separately. Both SDK packages are published at 3.14.1 and exact-source required-lane qualification passed. Per-operation runtime parity and a live OAuth/repository journey remain separate verification boundaries; hosted baseline/gate/trace fields remain unavailable when the activation API cannot supply them.

How to read client gaps

The immutable TypeScript and Python SDK 3.15.0 archives use OpenAPI 13.8.0. This candidate’s source and the independently published Go SDK 3.15.0 use OpenAPI 13.9.0. Generated TypeScript contract types do not establish deployment of the corresponding server operations; endpoint availability remains separately qualified. Historical Required Test Lanes evidence remains the 3.7.1 artifact named in that inventory; that lane proof does not imply a dedicated convenience method in the TypeScript SDK, Python SDK, or CLI. Missing high-level client workflows are stated explicitly; use the API reference when only the typed REST contract is available.

Maintenance policy

Keep the entry path small: no new hub, Copilot mode or candidate workflow until the five-minute gate, anonymous executable sample and this inventory agree and their acceptance checks pass. Reaching a route or publishing a client cannot override missing workflow acceptance. A status change requires all of the following in the same released commit:

A supported UI or public API workflow with documented permissions and failure behavior.
OpenAPI coverage for every public route and generated-client parity where promised.
Tests at the appropriate unit, route, database, and end-to-end layers.
Observable evidence semantics, incomplete-state behavior, and operator recovery guidance.
An owner review of this inventory and the matching current-behavior manual.

Roadmap documents may explain direction, but they do not override this inventory. These guides do not change maturity labels. They explain how to read existing surfaces:

Platform map — Job → surface routing for the full product
Failure patterns — Named production failure patterns (/insights)
Risks & controls — Collaborative RACM under Proof
How the evaluation system fits together
Decision judges: Jev and typed outcomes
Evaluator qualification
Compare evaluators
Read evaluation evidence
Connect controls to actual evidence
Prepare review
Resolve inconclusive results

Canonical docs URL: evalgate.com/docs. Use each surface’s inventory status. Live route access alone does not promote maturity.

MCP release boundary

This inventory is generated from contracts/mcp-release-capabilities.json, the same registry that controls /api/mcp tool registration. Public schema discovery grants no authority. Calls require authentication and the actual role and scopes. Disabled tools are absent and guessed-name calls are rejected. The separate public documentation server remains read-only.

Capability	Release status	MCP enabled	Implemented tools	Qualification
review	Shipped	Yes	8	Released read-only review surface; actual calls require organization authentication and scopes.
connections	Shipped	Yes	9	Read tools need eval:read; every connection mutation stays admin-only by role and admin:workspace scope.
portable-quality	Not publicly released	No	11	Backend, authorization and hosted workflow acceptance required before MCP release.
authoring	Shipped	Yes	4	Write tools replay the caller credential through the REST routes that own each operation, so quotas, locks, idempotency, rate limits and audit apply unchanged.

Released public schemas: project_inspect, project_plan, evaluations_list, runs_list, run_explain, baseline_lineage, docs_search, connector_health, connections_list, connections_catalog, connections_roots, connections_graph.

Get Started

Core Concepts

Guides

SDK Reference

Platform

Feature status

Feature status

What you can use today

API documentation publication boundary

Source and release history

How to read client gaps

Maintenance policy

MCP release boundary

​Feature status

​What you can use today

​API documentation publication boundary

​Source and release history

​How to read client gaps

​Maintenance policy

​Related reading for evaluation and evidence layers

​MCP release boundary

Feature status

What you can use today

API documentation publication boundary

Source and release history

How to read client gaps

Maintenance policy

Related reading for evaluation and evidence layers

MCP release boundary