> ## Documentation Index
> Fetch the complete documentation index at: https://evalgate.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Feature status

> What you can use today, with source candidates and release evidence kept separate.

# Feature status

> October 31 SDK publication: [Go SDK 3.17.0](https://evalgate.com/docs/sdk/go.md) and
> [Ruby SDK 3.17.0](https://evalgate.com/docs/sdk/ruby.md) are publicly available through the Go module proxy
> and RubyGems. Independent clean consumers verify both installed packages,
> OpenAPI 18.4.0 and 915 operations. Publishing these clients does not establish
> hosted API availability or native framework/local-runner parity.

> October 29 source candidate: public NLWeb `/ask` adds bounded, rate-limited
> anonymous documentation search and v0.55 streaming; supplied credentials still
> require `docs:read`. Docs MCP adds typed listing pagination. OpenAPI 18.3.0 and
> regenerated client source describe these changes; exact deployed acceptance is
> pending. ChatGPT directory publication remains pending. No public hosted
> sandbox or postal address is added.

EvalGate's hosted platform is **Beta**. Start with the credential-free
[TypeScript local gate](https://evalgate.com/docs/quickstart-typescript.md), then break a case and verify
exit `2`. A passing gate means only that its configured checks passed.

| Status | Meaning |
| - | - |
| **Shipped** | Released supported workflow with recorded acceptance evidence. It does not imply an SLA or certification. |
| **Beta** | Available hosted product; support and procurement commitments require an explicit agreement. |
| **Experimental** | Available or source implemented with the interface or named workflow acceptance still incomplete. Read the evidence column. |
| **Planned** | Unavailable. Publishing a client does not enable the service. |

## What you can use today

The table owns availability. Source merges, package versions and historical
qualification notes below do not override it. **3.17.0 application** and
**3.17.0 SDK** identify this source line; the published TypeScript/Python 3.15.0
archives remain immutable. Candidate hard budgets, cost approval, scoring v2
and JUnit changes require their own release acceptance.

| Feature | Status | UI entry point | Public REST / OpenAPI operations | SDK and CLI | Verification evidence | Owner |
| - | - | - | - | - | - | - |
| [API assertion test mode](https://evalgate.com/docs/platform/api-test-mode.md) | **Experimental** | Public assertion executor at `/api/demo/custom-eval` | Candidate `getAssertionTestMode` and `runAssertionTestMode` | Generated TypeScript/Python clients and generic `evalgate api`; requires a client release containing the operation IDs | Bounded stateless assertion contract; source tests and exact deployed GET/POST acceptance are separate; no hosted CRUD sandbox | Developer Experience |
| [Evidence workspace preview](https://evalgate.com/docs/platform/evidence-workspaces.md) | **Experimental** | Optional trace, evaluation, knowledge, review, analytics and administration presentation | Canonical trace tool evidence, reviewer-bound Arena preference and revision-bound discussion contracts; existing product mutations remain authoritative | Generated TypeScript/Python and generic CLI operations; no new model or release authority from presentation | October 27 source candidate reconciles the 54-pattern research shortlist. Default-off build-time rollout; local regression evidence and exact deployed acceptance are separate. Historical availability, named integrations and model qualification are not implied | Product Experience |
| [Connections experience](https://evalgate.com/docs/platform/connections.md) | **Experimental** | `/connections`, Settings → AI providers and Setup | Canonical accounts, reviewed lifecycle and native source discovery/grant/operation contracts | Shared REST and generated TypeScript/Python/CLI contracts; released MCP reads retain their separate boundary | October 22 source candidate implements the 23 former Coming soon connectors with explicit operation/format limits. Named-account authorization, configured credential storage, migration and exact-deployment acceptance remain required; saving a setup does not prove access. | Integrations |
| [Portable quality for non-repository work](https://evalgate.com/docs/platform/portable-quality.md) | **Planned** | Unshipped candidate source adds `/quality`; the released application does not expose it | Candidate source implements authenticated context/revision/resource upload and query, canonical checks, grounded corrections, explicitly approved standards, later-task standard reuse, grants, delivery, and lifecycle routes. Production defaults fail closed behind independent capture, ingestion, check, background, learning, and host flags; evidence reads and safety controls remain available during rollback | TypeScript/Python clients and CLIs are packaged in SDK 3.13.1 with clean-install registry proof, including resumable upload and credential-free no-repository local mode. Candidate MCP adds eleven exact-scope tools, including approved-standard plan creation, canonical-result evidence, and evidence attestation for checks waiting on evidence. Public Skills route portable artifacts capability-first. SDK publication does not establish deployment of the corresponding cloud API, web or MCP surfaces | Local proof covers additive migrations, tenant/ACL denial, durable Postgres/Redis jobs, worker-produced failed/pass canonical runs, service-level correction → approval → later-task reuse, packaged Node 24 parser/query/check workers, worker kill/restart, 3,000,000-row CSV, multi-sheet XLSX semantics, scoped learning, cross-host protocol fixtures, OpenAPI/SDK parity, installed packages, MCP protocol, and feature-off API/worker controls. Seeded authenticated browser acceptance, public-route composition proof, named hosts, live providers, and exact application deployment remain open under DISC-20261003-001 and the Portable Quality discovery entries | Platform Foundations |
| [Credential-free cloud-agent local gate](https://evalgate.com/docs/quickstart.md) | **Experimental** | None; repository CLI execution | None; local execution deliberately creates no hosted identity | TypeScript and Python CLIs in `@evalgate/sdk@3.15.0` / `evalgate-sdk==3.15.0` expose `evalgate init --local`, `baseline update`, `status --json` (and `--format json`), and `gate --format json`; JSON/non-TTY init requires explicit `--apply`. Each CLI evaluates only its own runtime's specs, so a Node project is not runnable by the Python CLI and the reverse also holds. No REST surface. | Packed-candidate cold start (no auth, no remote, network denied, path with spaces) and a real published-3.8.2→candidate upgrade both pass and fail closed (`pnpm agent-experience:cold-start`, `pnpm agent-experience:upgrade`); zero network attempts counted with the guard proving activation. TypeScript/Python parity is NOT complete — see DISC-20260903-003 remaining items 1–2. PyPI remains separately governed; exact-head CI | Developer Experience |
| [GitHub repository access and Repository Intelligence](https://evalgate.com/docs/platform/repository-activation.md) | **Experimental** | `/setup` → Connect a GitHub repository, then `/repository-intelligence` | `get_integrations_github`, `post_integrations_github`, activation preview/apply, and the repository list/scan/ask operations | Generated TypeScript, Python, and CLI REST contracts. `@evalgate/sdk` (3.12 line) separates durable link identity from exact-commit activation snapshots, reports commit relationships without unlinking, and adds matching `login`, `whoami`, `link`, `status`, `open`, and `logout`; 3.12.3 adds recoverable App user-OAuth for install claims | Commit-graph service/route tests, DOM, workspace DOM, Unit, PostgreSQL, and focused TypeScript/Python CLI source tests; live device flow, App installation, private-repository scan/Copilot, exact-head CI, and production browser proof remain open | Integrations |
| [Playground](https://evalgate.com/docs/platform/feature-manuals.md#playground) | **Shipped** | `/playgrounds`, then `/evaluations/{id}/playground` | `get_playgrounds`, `get/post/patch_evaluations_id_playground`, plus documented winner, variant, scorer, run, proposal, case, assistant, cancellation, and export operations | No dedicated client methods; use REST | API and persistence tests; exact-head CI | Evaluation Workflows |
| [Prompt Hub](https://evalgate.com/docs/platform/feature-manuals.md#prompt-hub) | **Shipped** | `/prompts` and an evaluation detail page | `get_prompts` and the evaluation prompt/version operation family | CLI sync supports prompt pull/push; no complete convenience-client surface | Prompt route tests; exact-head CI | Evaluation Workflows |
| [Scorer Studio](https://evalgate.com/docs/platform/scorer-studio.md) | **Shipped** | Measurement → Scorers (`/measurement?view=scorers`; `/scorers` redirects) and `/scorers/{scorerId}` | `/api/scorers` plus version, example, test, alignment, calibration, publish, binding, and usage operations | No dedicated SDK or CLI; use the authenticated REST workflow | Scorer workflow proof and hostile-code OCI boundary proof; exact-head CI | Evaluation Workflows |
| [Red-Team Workbench](https://evalgate.com/docs/platform/red-team-workbench.md) | **Shipped** | `/red-team` | `/api/red-team` risk-pack, campaign, run, release-evidence, finding, remediation, and signed-report operations | SDK 3.13.1 includes generated TypeScript and Python clients plus CLI commands: `evalgate red-team evidence --run <run-id>` compiles, verifies, and atomically persists exact-run evidence; `evalgate red-team finding --finding <finding-id>` reads persisted source states and commit-pinned graph/locator evidence. Strict gates pin organization, campaign scope, target, and trust anchor; campaign orchestration remains an explicit REST workflow | Red-team workflow, durable compiler, route, TS/Python CLI and failure taxonomy, persisted finding-to-source DB/API/DOM proof, and gate test source pass locally; exact-head CI passed for the SDK 3.13.1 source; corresponding production deployment and live-provider qualification remain separate requirements | Evaluation Workflows |
| [Logs & Trace Explorer](https://evalgate.com/docs/platform/logs-explorer.md) | **Shipped** | Evidence → Logs (`/evidence?lens=logs`; `/logs` redirects) | `/api/logs` query, detail continuation, aggregate, saved-view, cohort, bulk-action, and audited-export operations | No dedicated TypeScript, Python, or CLI convenience workflow; use authenticated REST | Unit, API, database, DOM, and golden-path proof source; exact-head CI | Production Intelligence |
| [EvalGate Copilot](https://evalgate.com/docs/platform/evalgate-copilot.md) | **Experimental** | `/copilot` and supported product surfaces | `/api/copilot` thread, retained-context, message, action, proposal, accept/apply, and reject operations. An action turn may run bounded, read-only dataset queries (search, count, rows, run outcomes; at most 50 rows per call, 8 calls per turn) and returns each with its scope and row citations; semantic search answers unsupported. Proposals may create a new draft dataset or evaluation, applied only on acceptance | No dedicated SDK or CLI convenience workflow; use authenticated REST and the review UI | Unit, API, database, DOM, and golden-path proof source; exact-head CI. Dataset tools and creation proposals: organization-isolation and apply-path DB tests and query-scope DOM test on the readiness branch; no released-availability claim | Evaluation Workflows |
| [Remote Runners](https://evalgate.com/docs/platform/remote-runners.md) | **Shipped** | `/remote-runners` | `/api/remote-runners` registration, credentials, lifecycle, enqueue, claim, heartbeat, stream, cancellation, lease recovery, completion, and reconciliation operations | TypeScript and Python worker SDKs implement the signed protocol. SDK 3.13.1 includes experimental `evalgate serve`, which runs a customer command per case and registers executable targets (`/api/remote-runners/targets`); use requires a matching deployed server contract | Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI | Evaluation Runtime |
| [Deployable Assets](https://evalgate.com/docs/platform/deployable-assets.md) | **Shipped** | Releases → Deployment (`/releases?view=assets`; `/deployable-assets` redirects) | `/api/deployable-assets` list/create, approval, transition, rollout, health, and governed invocation operations | Generated contract types only; no complete TypeScript, Python, or CLI deployment client | Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI | Evaluation Runtime |
| [Trajectory Analysis](https://evalgate.com/docs/platform/trajectory-analysis.md) | **Shipped** | Evidence → Trajectories (`/evidence?lens=trajectories`; `/trajectory-analysis` redirects) | `/api/trajectory-analysis` ingestion, detail, scoring, comparison, report, and retention operations | TypeScript and Python clients cover ingestion, inspection, scoring, reporting, and comparison; no dedicated CLI command | Unit, API, PostgreSQL, DOM, and golden-path proof sources; exact-head CI | Evaluation Quality |
| [Dashboards and monitors](https://evalgate.com/docs/platform/dashboards-monitors.md) | **Shipped** | `/dashboards` and pinned `/dashboards/shared/{token}` views | Metric-definition, metric-query, dashboard/version/widget/render/share, and stateful alert/event/delivery operation families | No complete TypeScript, Python, or CLI convenience workflow; use the authenticated REST contract | Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI | Evidence & Reporting |
| [Failure patterns](https://evalgate.com/docs/platform/failure-topics.md) | **Shipped** | `/insights` (UI title: Failure patterns; API resource family remains failure-topics) | Topic discovery/detail/version controls, merge/split, Gateway label proposals, and governed corrective actions framed as named failure patterns with why-it-matters and next-state cues | No dedicated TypeScript, Python, or CLI convenience workflow; use authenticated REST | Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI; UX compression investigation framing on main | Production Intelligence |
| [Dataset Hub](https://evalgate.com/docs/platform/dataset-hub.md) | **Shipped** | `/datasets` | `/api/datasets` dataset, row, import, trace-conversion, health, version-lifecycle, and diff operations plus evaluation dataset bindings and run dataset snapshots | TypeScript `client.datasets` and Python `DatasetHubAPI`; TypeScript and Python CLI `evalgate datasets` list/create/import/version/publish/bind | Dataset Hub route tests; exact-head CI | Evaluation Workflows |
| [Experiments](https://evalgate.com/docs/platform/experiments.md) | **Shipped** | `/experiments`, plus **Promote from Playground** | `get_experiments`, `post_experiments`, run/cancel/progress/results/compare/decision/publish-winner operations, and `post_evaluations_id_playground_promote_to_experiment` | No dedicated TypeScript, Python, or CLI Experiment client; use authenticated REST or `evalgate api` | Experiment route tests; exact-head CI | Evaluation Runtime |
| [Continuous Eval Studio](https://evalgate.com/docs/platform/continuous-eval.md) | **Shipped** | `/online-evals` and `/online-evals/{monitorId}` for draft, simulation, activation, operation, and remediation | Monitor/version CRUD, simulate/activate, pause/resume, bounded backfill/cancel/resume, sample/run/health/topic/candidate reads, alert delivery, and verified remediation operations under `/api/online-evals/*` | No dedicated TypeScript, Python, or CLI monitor workflow; use authenticated REST | Unit, API, PostgreSQL lifecycle, DOM, and golden-path proof source; exact-head CI | Evaluation Runtime |
| [Review Queue](https://evalgate.com/docs/platform/feature-manuals.md#review-queue) | **Shipped** | `/review` | `get_evaluations_id_human_review`, `post_evaluations_id_human_review`, `post_evaluations_id_human_review_reviews` | CLI review supports local/gate workflows; no complete queue client | Review route tests; exact-head CI | Trust & Review |
| [Synthetic and golden lifecycle](https://evalgate.com/docs/platform/feature-manuals.md#synthetic-and-golden-lifecycle) | **Shipped** | Releases → Candidates (`/releases?view=candidates`; `/candidates` redirects) and evaluation Synthesize/Test Cases panels | `get_candidates`, `get_candidates_id`, `patch_candidates_id`, `post_candidates_id_replay`, `post_candidates_id_promote`, and evaluation-scoped review/promotion operations | CLI `synthesize`, `promote`, and `replay`; TypeScript and Python canonical golden-case support | Promotion DB tests; exact-head CI | Trust & Review |
| [Model Gateway](https://evalgate.com/docs/platform/feature-manuals.md#model-gateway) | **Shipped** | Settings → AI providers (`/settings/connections`) | `get/post_model_gateway_configs`, config detail/health/rotation, routing-profile, model-sync, call-ledger, and test-call operations | No dedicated generated gateway client or CLI | Gateway ledger DB tests; exact-head CI | Gateway & Providers |
| [Evals-as-Code](https://evalgate.com/docs/platform/feature-manuals.md#evals-as-code) | **Shipped** | CLI/CI first; evaluation pages show applied results | `post_evals_as_code_validate`, `post_evals_as_code_plan`, `post_evals_as_code_diff`, `post_evals_as_code_apply`, `post_evals_as_code_gate`, manifest/apply/drift operations | TypeScript CLI is the primary client; Python parity remains incomplete | Rollback and drift DB tests; exact-head CI | Developer Experience |
| [MCP review surface](https://evalgate.com/docs/platform/mcp-integration.md) | **Experimental** | `/api/mcp` for coding/chat agents, public `/api/mcp/docs` for reviewed product documentation; legacy `/api/mcp/tools` remains documented separately | Released inventory: stateless MCP `2026-07-28`, public protocol and released read-only schema/resource discovery, authenticated scope- and role-filtered calls, eight read-only P0 review tools, a scoped run-evidence MCP App, stateless 2025 initialization fallback, and a separate anonymous docs server. Connection-management and eleven Portable Quality MCP implementations are not publicly enabled; the generated release boundary below controls discovery and direct calls | RFC 9728 metadata links to first-party RFC 8414 authorization-code/PKCE and RFC 8628 device flows. Public clients use exact registered redirects; a signed-in person chooses the organization and scopes before EvalGate issues a revocable 90-day API-key token. No refresh token or production-like sandbox is offered | Released surface: source conformance, schema parity, PKCE validation, App-resource, and public-docs isolation tests. Candidate Portable Quality MCP: 26 protocol tests plus 1,356 route/scope checks; no exact deployment or named-client claim. Status remains experimental until migration, exact deployment, and the real-client compatibility matrix pass; exact-head CI | Agent Native Surfaces |
| [Agent Skills distribution](https://evalgate.com/docs/guides/write-evals-with-your-agent.md) | **Experimental** | `npx skills add evalgate/skills`, the public `evalgate/skills` repository, and `/.well-known/agent-skills/` | One primary `evaluate-ai-change` decision framework plus five focused setup, gate, trace, repository, and MCP Skills; progressive references cover behavioral impact, authoring, regressions, experiments, cost, evidence, invalid runs, and the canonical nine-value decision contract with required quality, protected-slice, reliability, latency, and cost reporting | Skills invoke documented CLI/API/MCP contracts but do not enforce policy, grant credentials, expose private scoring logic, or make an unevaluated release safe | Pinned `skills` CLI discovery and selected-install proof for Codex, Cursor, GitHub Copilot, OpenCode, and Zed; eleven provider-neutral decision scenarios cover every classification and release decision, including a mixed bug sweep that scores decision correctness separately from reporting completeness. Default-branch promotion, hosted CI, broader multi-model trials, and skills.sh re-indexing remain pending; exact-head CI | Agent Native Surfaces |
| [Provider onboarding](https://evalgate.com/docs/platform/model-providers-byok.md) | **Experimental** | Connections → Add a connection; provider-key setup is temporarily unavailable in the hosted application while credential storage is restored | Provider-key REST plus Model Gateway config, health-check, model-sync, and test-call operations; configured storage and provider authorization are prerequisites | Generated contract types only; no dedicated onboarding convenience client or CLI | Local DOM/browser fixtures do not prove production credential storage; hosted setup remains under release qualification | Gateway & Providers |
| [Infisical vault-linked provider keys](https://evalgate.com/docs/platform/model-providers-byok.md#keep-provider-keys-in-your-infisical-vault) | **Experimental** | Connections → Secret managers; depends on the same hosted credential storage as provider keys | `/api/org/credential-vaults/infisical` connect, list secret names, link, check, unlink and disconnect; direct providers only (OpenAI, Anthropic, Google, xAI, Moonshot) | Generated contract operations and `evalgate api`; no dedicated convenience client | Real-database tests with a simulated Infisical server; no live Infisical Cloud or production acceptance yet; Model Gateway credentials and self-hosted Infisical unsupported | Gateway & Providers |
| [Calibration control plane](https://evalgate.com/docs/platform/calibration-control-plane.md) | **Shipped** | Measurement → Calibration (`/measurement?view=calibration`; `/calibration` redirects), plus evaluation-detail and Measurement → Judges workflows | Anchor-set/version/review, mapping/review/diff/drift, workspace, release-gate, scorer-binding, and existing evaluation calibration-proposal operation families | Judge execution exists in both SDKs; no complete SDK or CLI control-plane workflow | Unit, API, PostgreSQL, DOM, and golden-path proof source; exact-head CI | Trust & Review |
| [Evaluator measurement integrity](https://evalgate.com/docs/platform/evaluator-qualification.md) | **Shipped** | `/evaluator-validation` measurement workspace, plus run summaries through existing evaluation APIs | Release/run lifecycle, coverage-aware policy sampling, automatic post-run validation, delayed outcome attribution/recomputation, canonical AB/BA judge execution, interval-bearing causal metrics, observation execution, metric reads, and measurement-bound release/Evals-as-Code gates | TypeScript and Python SDK measurement clients, including delayed outcomes; `evalgate measurement` lists releases/runs, inspects metrics, and executes validation runs | Measurement API and database tests; production browser proof remains release-gated; exact-head CI | Evaluation Quality |
| [Golden Release / AI regression bot](https://evalgate.com/docs/platform/feature-manuals.md#deployment) | **Experimental** | Releases → Golden gate (`/releases?view=golden`; `/golden-release` redirects) candidate inbox, decision header, and publication panel (flag-gated) | Sealed OTEL revisions, canonical measurement revisions, GitHub App webhook/publication/check APIs behind `EVALGATE_*` flags | No dedicated generated SDK convenience client yet; composite Action and sticky comment remain supported | Golden Release vertical proof; sandbox GitHub App and production browser proof outstanding; exact-head CI | Evaluation Quality |
| [Governed Full-Harness Improvement Loop](https://evalgate.com/docs/platform/unified-eval-loop.md) | **Experimental** | `/improvement` | Organization-scoped `/api/improvement` reads (cycle list/detail, hypotheses, candidates, candidate diff, attempts, partitions, events, scenarios, runs) and governed writes: start and cancel a sandbox run, compile and approve an Optimization Contract for the next run, authorize, and adopt | Generated TypeScript and Python operations; `evalgate improve` covers cycles, inspect, run, watch and adopt. Contract approval and adoption under a contract require a person signed in; API keys and MCP tokens are refused. Shadow, canary, promote and rollback are not client actions | Real-execution proof (17 tests spawning real child processes), non-prompt acceptance scenario (15 tests, 120 real executions), mutation adapters, statistical decision rules, and learning compilers, OpenRouter model broker (22 tests against a real loopback HTTP server), and comparison statistics, cross-organization isolation, CLI, and workspace DOM. **No released-availability claim:** no exact-head CI run, no browser proof, and no live-model or live-traffic evidence is claimed. A real OpenRouter adapter exists and is proven against a loopback HTTP server, but no run against a live model has been performed: this environment's network policy denies openrouter.ai. The default broker is a deterministic seeded behavioral model, not a language model. Scope and deferred items: ADR-009 and the operator reference | Platform Governance |
| [Risks & controls](https://evalgate.com/docs/platform/risks-and-controls.md) | **Experimental** | `/proof/risks-and-controls` | Authenticated `/api/proof/risks-and-controls/*` for risks, controls, safeguard bindings, walkthroughs, assignments, evidence request/submit/review, conclusions, findings, risk acceptance, and reviewed-scope export. Reviewed profiles provide control-counted inventory, organization/system applicability and requirement references | Existing workflows use authenticated REST and Proof UI; discovery/profile operations are generated for TypeScript/Python and generic `api` CLI in source. Discover installed capabilities; source generation is not registry publication | Discovery and profiles are merged with exact-head CI, disposable native PostgreSQL and authenticated browser qualification. Production migration0258 and operational deployment readiness passed October17; the authenticated production control journey remains unverified. Unverified standards references and missing evidence grant no conformance, effectiveness or release authority; guest portals and collectors remain separate optional paths | Trust & Review |
| [Reports](https://evalgate.com/docs/platform/feature-manuals.md#reports) | **Shipped** | Shared/signed evaluation reports from evaluation runs and Unified Eval Loop seal | `get_reports`, `post_reports`, verification operations under `/api/reports` | Generated contract types; CLI and UI share signed-report flows where documented | Reports verify route tests; exact-head CI | Evidence & Reporting |
| [Asset Portability](https://evalgate.com/docs/platform/asset-portability.md) | **Shipped** | Releases → Portability (`/releases?view=portability`; `/portability` redirects) inventories prompt, dataset, calibration, scorer, failure\_memory, approval, and institutional\_context; evaluations, golden cases, red-team, deployments, experiments, and eval-loop workflows are omitted | `/api/portability` export/import for those seven kinds | Generated contract types only; no complete TypeScript, Python, or CLI convenience client | Portability DOM tests; exact-head CI | Developer Experience |
| [Deployment](https://evalgate.com/docs/platform/feature-manuals.md#deployment) | **Shipped** | CI and release workflow; no single deployment dashboard | `get_releases`, `post_releases`, plus Evals-as-Code gate/apply operations | TypeScript CLI and CI integrations are primary; Python parity remains incomplete | Golden path; exact-head CI | Developer Experience |

## API documentation publication boundary

| API family | Status | Namespace |
| - | - | - |
| Portable quality | **Planned** | `/api/portable-quality` |

The public API-page generator omits this namespace until its inventory status
is Shipped. Legacy evaluation quality at `/api/quality` is a separate API.

> [accordion] Source candidates and release history
>
> ## Source and release history
>
> **October 31, 2026 Go and Ruby SDK publication:**
> [Go SDK 3.17.0](https://github.com/evalgate/evalgate-go/releases/tag/v3.17.0)
> is published as `github.com/evalgate/evalgate-go/v3@v3.17.0`, generated from
> OpenAPI 18.4.0 with 915 operations. Native HTTP/model tests, `go vet`, checksum
> database verification and an independent public-proxy consumer installation pass.
> [Ruby SDK 3.17.0](https://rubygems.org/gems/evalgate-sdk/versions/3.17.0)
> is published as `evalgate-sdk` on RubyGems. Native HTTP tests, RBS validation,
> gem build and an independent credential-free public-registry installation pass.
> The downloaded gem matches the reviewed SDK-only artifact. SDK client source is
> distributed separately from the private application. Package release
> does not deploy corresponding cloud APIs or change the availability table above.
>
> **October 21, 2026 enterprise identity candidate (PR763):** organization-owned
> SAML/OIDC sign-in, verified domains, MFA policy and recovery are implemented in
> source against OpenAPI 13.9.0 and migrations 0262/0264. Live Okta/Entra and deployed
> enterprise acceptance remain pending; this is not a production-verified SSO
> availability claim. Identity changes are restricted to owners with an
> interactive session; authorized owner credentials can read the configuration.
> Generated TypeScript, Python and CLI operation contracts do not authorize
> API-key, saved CLI-session or OAuth mutations of identity settings.
> SCIM and SAML single logout are unsupported. See
> [authentication](https://evalgate.com/docs/authentication.md) for enforcement and credential-cutover behavior.
>
> **October 28, 2026 release candidate (3.17.0):** The candidate contains
> **3.17.0 application** and **3.17.0 SDK** source with generated clients for
> OpenAPI 18.2.0. It supersedes the unpublished 3.16.0 candidate and carries its
> changes, adds vault connections, the provider policy mode, blind Arena review,
> adjudication comments, trace tool-call evidence, validated UTC schedules and
> opt-in binary scan evidence and machine-payment agent top-ups, and clears every high and critical dependency
> advisory. Registry installation requires the `sdk/v3.17.0` publication; the
> published 3.15.0 archives remain unchanged. The released inventory below is
> not promoted by this candidate note.
>
> **October 26, 2026 release candidate (3.16.0, unpublished):** The candidate contains
> **3.16.0 application** and **3.16.0 SDK** source with generated clients for
> OpenAPI 17.0.0. It reports unmeasured safety as unknown instead of passing,
> requires an accepted cost bound for Copilot actions and an idempotency key for
> automated adjudication, and upgrades production dependencies with critical and
> high advisories. Registry installation requires the `sdk/v3.16.0` publication;
> the published 3.15.0 archives remain unchanged. The released inventory below is
> not promoted by this candidate note.
>
> **October 21, 2026 source candidate (PR #764):** The candidate contains
> **3.15.0 application** and **3.15.0 SDK** source. These versions do not identify
> the deployed application or upgrade existing published archives. The Ora follow-up implements
> first-party `agent_auth` service registration and human-approved claims, a local
> Docker API sandbox, generated Go/Ruby clients and managed outbound Web Bot Auth
> signing. It extends public authored Markdown coverage to 80 routes and updates
> MCP cards and NLWeb streaming. These source changes use OpenAPI 13.9.0; database,
> native package, sandbox and exact-deployment checks remain separate acceptance
> boundaries. Registry installation requires a verified package publication. No
> hosted public sandbox, third-party identity-assertion trust or incoming-bot
> verification is advertised. The released inventory below is not promoted by
> this candidate note.
>
> **October 21, 2026 Go publication:** The official
> [Go SDK 3.15.0](https://github.com/evalgate/evalgate-go/tree/v3.15.0) is
> published as `github.com/evalgate/evalgate-go/v3@v3.15.0`. Native HTTP/model
> fixtures and a clean independent installation through the public Go module
> proxy pass. Its generated contract uses OpenAPI 13.9.0. Package publication
> does not deploy the corresponding cloud APIs; follow this inventory and the
> server's advertised capabilities for endpoint availability. The [Ruby SDK](https://evalgate.com/docs/sdk/ruby.md) also passed native
> HTTP tests, RBS validation, gem build and clean local installation. At that time,
> RubyGems publication awaited account-owner trusted-publisher setup.
>
> **October 21, 2026 TypeScript/Python publication:** npm and PyPI both
> serve SDK **3.15.0**, confirmed directly from their registry metadata. Package
> publication does not establish the deployed application identity or live
> third-party qualification. Integration adapters remain fixture-qualified. The
> OpenAPI 13.9.0 TypeScript/Python source changes in PR #764 require a new immutable
> release before registry installation can provide those newer contracts; the
> existing 3.15.0 archives must not be overwritten.
>
> **October 18, 2026 release:** **3.14.1 SDK** is published as
> **@evalgate/sdk\@3.14.1** on npm and **evalgate-sdk==3.14.1** on PyPI, from
> merge commit `a02e835d416ac7afa0ee7b15841acd156ca6b082`.
> All three registry archives match their original publisher files. Fresh external
> installs pass SDK imports, CLI versions and capability JSON checks; their lockfile
> and wheel download hashes bind to those verified originals. The npm
> [tarball](https://registry.npmjs.org/@evalgate/sdk/-/sdk-3.14.1.tgz) shasum is
> `5d5466e9868b65fe6b5a47d8e9f8c6d871c04d01`; the
> [PyPI wheel](https://pypi.org/project/evalgate-sdk/3.14.1/#files) SHA-256 is
> `2943aa2f4e5d10f39124166f0f5b44a7f1c28c977c45c3e7123d3143a3e559fd`.
> Both packages report **OpenAPI contract 13.7.0**, including the breaking
> 13.0.0 scan-enqueue response. Exact-source required lanes, coverage, the complete
> browser suite and SDK compatibility matrix passed before publication.
> The failed 3.14.0 tag remains preserved; 3.14.1 is the first published 3.14 release.
>
> **3.14.1 application** passed dated core-readiness checks at the same source
> on October 18 (04:58–05:08 UTC): canonical/provider HTTP, actual schema,
> database/Redis and the public browser surface agree. Selected database
> configuration and bounded worker connectivity are verified. Authenticated
> control journeys and the workload boundaries below remain open.
>
> **Workflow availability remains separate:** the October 17 maintenance applied the
> pending schema upgrade. The canonical site, provider instance, database, Redis
> and repository/general queue worker passed operational readiness checks. The
> authenticated control workflow still needs production journey verification;
> namespace-dependent workloads lack verified capable placement. Published
> client contracts do not establish that every cloud operation is available. Passing
> qualification does not certify live provider calls, every connector backend,
> external collector receipts or independent review/export workflows. Preserve
> the per-operation boundaries below. See [release notes](https://www.evalgate.com/changelog)
> and the [agent quickstart guide](https://evalgate.com/docs/guides/agent-discovery.md).
>
> **Current follow-up candidate:** scoped evidence assessment in the existing
> control-review form, a PostgreSQL external erasure ledger, restricted runtime
> database-role planning and asynchronous isolated table queries are under
> qualification. They require the matching application/worker deployment and
> additive schema where applicable. Local fixtures and generated source clients
> do not establish production availability or publish another SDK version.
>
> The current TypeScript line still includes the activation-compression
> workflow from 3.9.0 plus credential-free local start: device-flow `login`,
> `whoami`, remote-revoking `logout`, auto-detecting `link`, unified `status`,
> control-plane `open`, TTY-aware `init`, and `init --local` for sandboxes without
> account, browser, GitHub remote, or network. Durable organization/repository/root
> linkage remains stored in non-secret version 2 project context separately from
> the exact target SHA and immutable manifest of the last cloud activation.
> `status` derives local-gate readiness from the same preflight as `gate` and
> reports link, checkout, cloud snapshot, local-gate readiness, and cloud-target
> readiness separately. Both SDK packages are published at 3.14.1 and exact-source
> required-lane qualification passed. Per-operation runtime parity and a live
> OAuth/repository journey remain separate verification boundaries; hosted
> baseline/gate/trace fields remain unavailable when the activation API cannot supply them.

## How to read client gaps

The immutable TypeScript and Python SDK 3.15.0 archives use OpenAPI 13.8.0.
This candidate's source and the independently published Go SDK 3.15.0 use
OpenAPI 13.9.0. Generated TypeScript contract types do not establish deployment
of the corresponding server operations; endpoint availability remains separately
qualified. Historical Required Test Lanes evidence remains the 3.7.1 artifact named
in that inventory; that lane proof does not imply a dedicated convenience method
in the TypeScript SDK, Python SDK, or CLI. Missing high-level client workflows
are stated explicitly; use the [API reference](https://evalgate.com/docs/api/overview.md) when only the typed
REST contract is available.

## Maintenance policy

Keep the entry path small: no new hub, Copilot mode or candidate workflow until
the five-minute gate, anonymous executable sample and this inventory agree and
their acceptance checks pass. Reaching a route or publishing a client cannot
override missing workflow acceptance.

A status change requires all of the following in the same released commit:

1. A supported UI or public API workflow with documented permissions and failure behavior.
2. OpenAPI coverage for every public route and generated-client parity where promised.
3. Tests at the appropriate unit, route, database, and end-to-end layers.
4. Observable evidence semantics, incomplete-state behavior, and operator recovery guidance.
5. An owner review of this inventory and the matching current-behavior manual.

Roadmap documents may explain direction, but they do not override this inventory.

## Related reading for evaluation and evidence layers

These guides do not change maturity labels. They explain how to read existing surfaces:

* [Platform map](https://evalgate.com/docs/platform/platform-map.md) — Job → surface routing for the full product
* [Failure patterns](https://evalgate.com/docs/platform/failure-topics.md) — Named production failure patterns (`/insights`)
* [Risks & controls](https://evalgate.com/docs/platform/risks-and-controls.md) — Collaborative RACM under Proof
* [How the evaluation system fits together](https://evalgate.com/docs/concepts/evaluation-layers.md)
* [Decision judges: Jev and typed outcomes](https://evalgate.com/docs/platform/decision-judges.md)
* [Evaluator qualification](https://evalgate.com/docs/platform/evaluator-qualification.md)
* [Compare evaluators](https://evalgate.com/docs/guides/compare-evaluators.md)
* [Read evaluation evidence](https://evalgate.com/docs/guides/read-evaluation-evidence.md)
* [Connect controls to actual evidence](https://evalgate.com/docs/guides/connect-controls-to-evidence.md)
* [Prepare review](https://evalgate.com/docs/help/review/prepare-review.md)
* [Resolve inconclusive results](https://evalgate.com/docs/help/evaluations/resolve-inconclusive-results.md)

Canonical docs URL: [evalgate.com/docs](https://www.evalgate.com/docs). Use each surface’s inventory status. Live route access alone does not promote maturity.

### MCP release boundary

This inventory is generated from `contracts/mcp-release-capabilities.json`, the same registry that controls `/api/mcp` tool registration. Public schema discovery grants no authority. Calls require authentication and the actual role and scopes. Disabled tools are absent and guessed-name calls are rejected. The separate public documentation server remains read-only.

| Capability | Release status | MCP enabled | Implemented tools | Qualification |
| - | - | - | -: | - |
| review | Shipped | Yes | 8 | Released read-only review surface; actual calls require organization authentication and scopes. |
| connections | Shipped | Yes | 9 | Read tools need eval:read; every connection mutation stays admin-only by role and admin:workspace scope. |
| portable-quality | Not publicly released | No | 11 | Backend, authorization and hosted workflow acceptance required before MCP release. |
| authoring | Shipped | Yes | 4 | Write tools replay the caller credential through the REST routes that own each operation, so quotas, locks, idempotency, rate limits and audit apply unchanged. |

Released public schemas: `project_inspect`, `project_plan`, `evaluations_list`, `runs_list`, `run_explain`, `baseline_lineage`, `docs_search`, `connector_health`, `connections_list`, `connections_catalog`, `connections_roots`, `connections_graph`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.