Version 1.7.0

SOIT v1.7.0 is the approval assignment release, released on 2026-10-03: approval requests name who decides them and by when, can be delegated, keep their history, and workflow runs continue on their own once a request is decided.

Highlights

• Approvers — a request can be assigned to members (assignee_user_ids) and workspace roles (assignee_roles: Owner, Admin, or Dev). Only those members, and the holders of those roles when the decision is taken, may approve or reject it; a member removed from the workspace or no longer holding the role can no longer decide. A request with nobody assigned keeps the earlier rule: any member who can write decides. See Approvals.
• Approvers and deadlines in the ToolSpec — policy.approval takes approvers and timeout_seconds, so every request a tool opens, from an agent, a workflow node, a direct call, or MCP, is assigned and has a deadline.
• Expiry — a request nobody decided by its deadline closes as expired, which counts as a rejection everywhere: the call never runs. Nothing approves a request on its own.
• Delegation and history — an approver can hand a request to another member who can decide, and every decision, closing, and delegation is kept in the request's history (GET /api/v1/observe/approvals/{id}/decisions).
• Workflow runs resume on the server — a workflow run stopped for approval continues once the request is decided, as the member who started it; nobody has to resume it by hand. It continues exactly once, however often the decision event arrives and whoever resumes it by hand at the same moment.
• Notifications — opened requests notify their approvers, delegated requests the new approver, and expired requests their requester, through members' notification preferences and the workspace's channels.
• Govern › Approvals — shows each request's approvers and deadline, filters to the requests assigned to you, offers Approve and Reject only where you may decide, and opens a request's details, history, delegation, and cancellation.
• Approval fixes of v1.6.1 — a resumed workflow run acts on the decision instead of skipping its approval gate, exactly one decision is taken per request, and canceled requests and the requests of ended runs are closed.
• soit-cli 1.7.0 is on PyPI.

Database compatibility

• Fresh installations migrate from base to 20261003100000.
• One migration is added: 20261003100000 adds assignee_user_ids, assignee_roles, and expires_at to approval_requests, and the approval_decisions table. Existing requests stay unassigned and never expire.
• The supported N-1 upgrade range is 20260927160000..20261003100000: a v1.6.x database (20261002120000) upgrades in place.
• The migration has a downgrade. Downgrading to 20261002120000 drops the assignees, the deadlines, and the whole decision history. Restoring the pre-upgrade backup is the preferred way back.

Upgrading

Back up the database and object storage, run alembic upgrade head, and restart the API, the workers, and the web console on the new images. No setting is added; keep APPROVAL_SWEEPER_ENABLED=true on the API service, which now also expires overdue requests. Review the behaviour changes — workflow approvals resuming on the server, Owners and Admins notified of unassigned requests, new fields on approval responses and events — in Migration and Upgrade.

Known limitations

• Escalation to other approvers when a deadline passes, assigning requests by policy rule, and multi-step or quorum approvals are not included.
• Nobody is reminded before a request expires; its requester is told after.
• A workspace cannot yet forbid members from approving their own requests.
• A direct tool call or MCP call still runs only when its caller sends it again after the decision.
• A workflow run whose starter left the workspace waits for a resume by hand.
• The known limitations of v1.6.0 still apply, except where the changelog lists them as fixed.

Related pages

• Approvals — the capability this release adds to.
• Migration and Upgrade — upgrade notes, including v1.6.1.