# Post-upgrade checks, 0.1.109 to 0.1.143

> The operator follow-up and the evidence to keep for every release from 0.1.109 to 0.1.143, for an install older than 0.1.144: the first part of the table in Upgrade and release verification, moved…

_Reference · Updated 2026-10-27 · Describes release 0.1.164_

The operator follow-up and the evidence to keep for every release from 0.1.109 to 0.1.143, for an install older than 0.1.144: the first part of the table in [Upgrade and release verification](/help/ops-upgrade-and-verify.md#post-upgrade-checks-by-release), moved here when that page reached its size ceiling. Read every release between the installed version and the target, oldest first, then continue with 0.1.144 and later on that page. The release notes are the authority; three versions are never installed (**0.1.106**, **0.1.115** and **0.1.127** — see that page).

| Release crossed | Operator follow-up | Evidence to retain |
|---|---|---|
| 0.1.109 | Keyless AWS any-account mode: customer-template roles assume only `aiops-*` estate roles. Merging the release does not migrate a rendered `envs/<slug>/` or `values.yaml`; follow [Adopt any-account keyless AWS](/help/ops-upgrade-and-verify.md#adopt-any-account-keyless-aws-on-an-existing-install) before enabling it. Test Lab fixes are lab code only. | The IAM change in that upgrade's Plan; `AIOPS_KEYLESS_AWS_ANY_ACCOUNT` in the rendered values |
| 0.1.110 | Daily posture snapshots are PostgreSQL rows: they are in the database backup. After the first UTC close, confirm that yesterday shows as a solid saved day on the Posture trend. Review the Scanner sync interval: an owner-configured pull can start paid analysis. | Posture trend after the first UTC close; **Scanner sync** interval and **Last automatic pull** |
| 0.1.111 | **Analyse P1/P2 findings automatically** is on by default for pulled Security Hub and Defender findings (`aiops_auto_investigate_p1p2`); backlog catch-up is off. Decide both on **Guardrails & cost** per workspace before the first pull after the upgrade: each analysis is a paid run. Roles changed: the builtin operator no longer decides approvals and the executive does. Review who holds approval rights. | Saved switch states; the roles grid on **Members & roles** |
| 0.1.112 | Change windows, emergency changes and the post-implementation review; the model residency policy. Where a workspace must stay in region, set **Singapore regulated (MAS/PDPA)** under **Guardrails & cost → Model residency** and pin the tiers on **AI models → Model tiers** to an allowed route. | The saved policy; a **Model route recorded** audit row naming the alias, backing model and region |
| 0.1.113 | Connections for a multi-account estate; several workspaces may share one keyless AWS role. Re-run **Test** on every connection after the upgrade. | Connection test results |
| 0.1.114 | Operational-record retention: platform default 365 days (`AIOPS_RETENTION_DAYS_DEFAULT`), sweep on (`AIOPS_RETENTION_SWEEP_ENABLED`). The first daily sweep removes closed records older than the window and seals the month's usage statement first. Set **Platform defaults → Data retention default** and each workspace's **Guardrails & cost → Data retention** to the agreed window *before* the first sweep. See [Security operations](/help/ops-security-operations.md#operational-record-retention). | The saved windows; the first `retention.swept` audit row and the `retention_last_sweep` result |
| 0.1.115 → 0.1.116 | Install 0.1.116, never 0.1.115. Platform checks give one answer per account: offender counts and the Posture trend step down once, and an exclusion holds only while its connection reads the resource — tell workspace owners. An impact basis can move from estimated to computed, so a pending approval asks for a new review: upgrade in a window with no pending approval. | Pending approvals = 0 before the upgrade; the one-time step on the Posture trend |
| 0.1.117 | The platform's model gateway restarts once when its configuration syncs; let it sync between runs. Every Bedrock gateway entry must state `aws_region_name` or the alias stays unpriced. The first official price sync runs by itself, then daily; a manual price needs a source note. Prompt caching is on by default for Claude routes. Without HTTPS to `pricing.us-east-1.amazonaws.com`, set `AIOPS_PRICE_SYNC_INTERVAL_S=0` and enter manual prices. | The price map with its sources; the re-book dry run |
| 0.1.118 | Press **Fetch list prices** on **Platform defaults → Model price map** after the deploy. Map what the table does not name from **Needs attention → Not mapped to a publisher model**, or record a manual price with its source. A workspace with its own AI endpoint books `$0` *Not priced yet* until the alias is mapped under **Workspace endpoints**; then **Re-price history (dry run)**. Egress: HTTPS to `models.dev` (or `AIOPS_MODELS_DEV_PRICES=false` and manual prices). | Fetch result; mapped aliases; the dry-run result; *Not priced yet* kept as a label, never as a zero cost |
| 0.1.119 | Every new switch is off by default (flapping, rollback-first, standard change for a runbook route, observed and unmanaged changes, residency, unmapped-alert triage, validation by metric, cloud auto-rollback, audit correlation). Six follow a platform default: `AIOPS_DEMOTE_ON_ROLLBACK`, `AIOPS_HOLD_FOR_APPROVAL`, `AIOPS_ROLLBACK_FIRST`, `AIOPS_RUNBOOK_STANDARD_CHANGE`, `AIOPS_UNMAPPED_TRIAGE`, `AIOPS_FLAP_THRESHOLD=0`. Decide each per workspace and roll private-network agents, which only follow forwarded settings they know. | The recorded switch decisions; agent versions |
| 0.1.120 | A webhook token that travelled in a URL (Amazon SNS subscription, Azure Monitor action group) can sit in stored rows. Mint a new one on **Alert intake & tokens** (**Mint webhook token**, then **Mint token**, `pillars.manage`); the old token stops at once, so update every sender in the same window, preferably with a header (`Authorization: Bearer` or `X-Webhook-Token`). An access log that recorded the token raises the **PII detected in collected telemetry** compliance incident on its next collection. The runbook-routes switch stays off. | The new sender delivery; the old token retired; never the token value |
| 0.1.121 | Roll private-network agents before relying on the route offer. A pre-approved route whose analysis used to create or edit a different file now waits for a person: look for **Automatic fix blocked** and give the route its own edit, or release it from the incident. | Route configuration review; the next execution or skip receipt |
| 0.1.122, 0.1.123, 0.1.124 | No schema or setting. Private-network agents need the releases for the fixes to apply to their runs (route binding; a human-run copy of a typed step keeps the standard class; the analysis no longer repeats a typed step). | Agent version |
| 0.1.125 | Routes pre-approved before the release migrate as *certified, certifier unknown*: an approver confirms or withdraws each on **Needs you → Certify** (the route's last editor cannot while another approver exists). A ticket route sends nothing unless it is in `api` mode against a ticket, paging or webhook connection; move others to the connection's **Tickets** preset. **Automatic API fixes for proven runbooks** stays off (`AIOPS_AUTO_REMEDIATION_DIRECT`). Billing is per occurrence; the validation ladder changes verify spend. | **Needs you** back to zero; each route's certifier; a ticket route's next send |
| 0.1.126 | No schema or setting. Private-network agents need it so their own scrubbing keeps the IMDS metric counts. | Agent version |
| 0.1.127 → 0.1.128 | **Do not install 0.1.127.** Replace any 0.1.127 install with 0.1.128, private-network agents included: they mask on their own. The `[credential hidden] hidden]` doubled mask can still appear in places; it is cosmetic. | Control-plane and agent version 0.1.128 or later |
| 0.1.129 | No schema or setting. Every audit row of an incident's lifecycle carries its correlation id once the process that writes it is upgraded: control plane, and private-network agents in database mode. | Agent version |
| 0.1.130 | No schema change, setting or permission. The first harvest after the upgrade can list EKS Auto Mode nodes as added and report a security group's relations as changed once; a change request reviewed before that harvest whose removed relations change needs a fresh review. Outside AWS writes gain an AWS Config before-state and a diff where `config_history: true` and the recorder are on; writes harvested before the upgrade keep the before-state note they were stored with and are not re-read, so they have no **Draft revert**. An escalated incident whose adopted ticket is resolved or closed in ServiceNow or Jira resolves when nothing else fires, unless **Keep an incident open while its fix waits for a decision** holds it. Upgrade the control plane and private-network agents together. | The first harvest record; a change with an AWS Config before-state; the ticket-driven resolve in an incident timeline |
| Record archive (the release after Ctrl+K) | New tables `archivebatch` and `archivedrecord` (additive). Nothing changes until `AIOPS_ARCHIVE_BUCKET` is set: retention keeps removing as before. To archive, apply the infrastructure `archive` unit and the `iam` change first (customer installs: re-run `bootstrap.sh apply` for the deployer policy), then set `config.AIOPS_ARCHIVE_BUCKET` and `AIOPS_ARCHIVE_REGION` in a window with no run in flight. Confirm the Ops console's **Data retention default** card shows the bucket with `container-role` before the first daily sweep; once the archive has run, removing the bucket setting pauses retention instead of deleting. Add the `AiopsArchiveStale` rule. | The card's storage line; the first batch's `retention.archived` audit row with its `manifest_sha256`; `aiops_archive_last_success_timestamp_seconds` per workspace |
| 0.1.142 | No schema change. Re-run the AWS CloudShell setup for every account it set up: its read role gains the Resource Explorer, `config:SelectResourceConfig`, Application Signals and `xray:GetServiceGraph` reads (a role on the `deploy/aws` module's `ReadOnlyAccess` already has them). Until then the harvest's Coverage lists them as denied and the hourly `topology.traced` audit row carries an `AccessDenied` error. The harvest now reads AWS Config's inventory by default (`config_inventory: false` opts a connection out), and the AWS service map is on by default (`service_map: false`); switch it off where the same traces also reach Tempo or Jaeger, whose pairs it would make ambiguous. The first harvest can list resources added from Resource Explorer and Config. | A harvest's Coverage on one AWS connection; one `topology.traced` audit row with an empty `errors` list |
| 0.1.143 | No schema change. Existing workspaces keep scoring SOC 2 / ISO 27001; new workspaces start with scoring off. The 13 checks of the platform's own settings leave the score (they still run and still open and close their control incidents), so the framework counts drop. Compliance findings pushed by webhook and failing platform checks at P3/P4 no longer start a run on their own. | The framework scoring switch (since 0.1.147 **Compliance frameworks (phase 2)** in Guardrails); a P3 compliance finding's `incident.not_actioned` receipt |


## Next steps

- Next: [Rollback](/help/ops-roll-back-a-release.md)
- [All Install and operate the platform pages](/help/install-and-operate-the-platform/llms.txt)
- [Documentation home](/help/)