SuperBased Files

Stable release on the stable channel (npm dist-tags latest + stable, PyPI, VS Code Marketplace and Open VSX). It promotes v1.34.0-rc.11 unchanged except for one release-script fix, and collects everything that shipped on edge across 1.34.0-rc.1 through rc.11 (rc.9 was tagged but never published). The per-RC sections below carry the full notes. Headlines since 1.33.0:

• Agent Access: SuperBased-minted agent identity and a governed MCP gateway (observer-mcpgw), off by default and inert when off (see docs/agent-access.md).
• Pricing chain: the full Tokenomics rate set reaches org and node pricing, the compiled price table is regenerated from the signed feed v9, model context windows come from Tokenomics, the org pricing feed gains a grade gate, and OpenAI Ultrafast turns are priced.
• Org guardrail control wave, the org admin assistant reaching every admin route, the shared design kit across the node and org dashboards, opt-in retroactive re-pricing, sandboxed-terminal containment, and a node dashboard performance pass.
• Enterprise deployment: cosign-signed observer-org, observer-postgres and harness-gateway images in the private registry, plus the release-pipeline fixes found while cutting the first pre-release tags.
• The VS Code extension publishes for the first time since 1.33.0 (the Marketplace refuses pre-release versions, so no RC reached it).

Upgrading from 1.33.0: node binaries run their agent migrations on observer start (head 147). On the org server run observer-org upgrade preflight and then observer-org migrate before starting the new image (server head 191, PostgreSQL head 0057; PostgreSQL 0032 needs btree_gist, see the rc.10 notes). On a node that was enrolled before rc.10, run observer org resync once (dry run by default, --confirm to queue).

Price snapshot: 2026-09-17 (aws us-east-1, azure eastus2, gcp us-central1)

• fix(release): the CHANGELOG price-snapshot check no longer misses a line that is present.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.34.0

Org server (Teams)

The self-hosted org server is an enterprise-licensed product distributed from SuperBased's private container registry with a per-customer pull token issued with your enterprise licence; its release assets are not attached here. Contact sales for a pull token. The pull-and-verify recipe for your exact release is the README.md of the deployment bundle (observer-org deploy export).

Enterprise updates

This release publishes on the stable channel.

Each agent archive carries a detached vendor signature (<archive>.sig, raw Ed25519 over the archive bytes) and the release ships a signed update-manifest-stable.json. Self-hosted org servers consume them with:

:::bash
observer-org update sync --version v1.34.0
observer-org update publish --channel stable --version v1.34.0

For a disconnected server, download observer-v1.34.0-airgap-bundle.tar (archives + signatures + SHA256SUMS + the signed manifest + provenance), carry it across the gap, and run observer-org update import --version v1.34.0 --bundle <dir>.

Supply chain

A CycloneDX SBOM for the agent is attached: observer.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

:::bash
slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private