> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nudj.cx/llms.txt
> Use this file to discover all available pages before exploring further.

# Release v2.453.16

> Released July 20, 2026

## 🔵 Release v2.453.16

⭐ Simple Complexity • 4 commits • 15 files changed

<Note>
  Security hardening release focused on protecting logging infrastructure. The Logtail logging token is now strictly server-only, preventing accidental exposure to browser clients. This release also includes improvements to MCP regression testing and CI/CD automation for better release reliability.
</Note>

## What's New

* **Server-Only Logging Token** — Logging source token now strictly server-only, preventing accidental browser exposure
* **Enhanced MCP Testing** — Deterministic regression test harness replays real-world MCP payloads to catch schema regressions
* **CI/CD Improvements** — Automated review state tracking and affected-only linting for faster feedback loops
* **Better Observability** — Clearer boot-time visibility for logging configuration issues

## Apps Updated

<CardGroup cols={3}>
  <Card title="User App" icon="mobile">
    — No changes
  </Card>

  <Card title="API" icon="server">
    ✓ Updated - 1 change
  </Card>

  <Card title="Admin" icon="gear">
    — No changes
  </Card>

  <Card title="MCP Server" icon="robot">
    ✓ Updated - 1 change
  </Card>

  <Card title="Models" icon="database">
    — No changes
  </Card>

  <Card title="Games" icon="gamepad">
    — No changes
  </Card>
</CardGroup>

## Detailed Changes

<AccordionGroup>
  <Accordion title="Observability & Security" icon="shield">
    **Server-Only Logging Token**

    * Logtail source token (`LOGTAIL_SOURCE_TOKEN`) is now strictly server-only
    * Removed acceptance of `NEXT_PUBLIC_LOGTAIL_SOURCE_TOKEN` to prevent accidental token exposure
    * This prevents Next.js from inlining logging tokens into browser bundles (which would expose tokens to all visitors)
    * Boot-time warning message now accurately reflects server-only configuration
    * Client-side observability (session replay, web vitals) remains available via `NEXT_PUBLIC_BETTERSTACK_TAG_TOKEN` as designed

    **Why this matters:** The Logtail source token grants full write access to your logging infrastructure. Accidentally exposing it to browsers would allow any visitor to write logs under your organization, potentially corrupting audit trails or causing data loss. This fix ensures the token stays protected on servers only.
  </Accordion>

  <Accordion title="MCP Server" icon="robot">
    **Regression Testing**

    * Deterministic MCP replay harness (`scripts/mcp-replay.ts`) now includes comprehensive test cases
    * Replays real-world payloads that previously failed, ensuring schema fixes don't regress
    * Tests handle model quirks like fill-all-fields behavior and XML transport coercion
    * Gate validates schema shape at transport boundary (catches bugs missed by unit tests alone)
    * 25+ deterministic test cases covering all major tool interactions

    **Why this matters:** Chat sessions are probabilistic — a model might emit a field 95% of the time, so three passing sessions don't guarantee a fix. The replay harness fires the EXACT payloads that previously bounced, catching regressions instantly without waiting for the right LLM output variance.
  </Accordion>

  <Accordion title="CI/CD Improvements" icon="workflow">
    **Automation & Linting**

    * Review automation state tracking now kept accurate across CI runs
    * Introduced affected-only linting (`pnpm lint:affected`) for pre-push validation
    * Full repository linting still runs in CI as the authoritative gate
    * Faster feedback loops for developers on feature branches

    **Workflow Governance**

    * Code Owner assignments updated for better review routing
    * Auto-approval workflows refined for safe configuration-only PRs
  </Accordion>
</AccordionGroup>

## For Administrators

No user-facing feature changes in this release. This is a stability and security update focused on infrastructure hardening.

**Recommended action:** No action required. This release improves platform security without requiring any configuration changes.

## For End Users

No user-facing changes in this release. Backend stability improvements only.

## Security Notes

This release hardens the logging infrastructure by ensuring that sensitive tokens cannot be accidentally exposed to users' browsers. The change is backward compatible — if you were using the `NEXT_PUBLIC_LOGTAIL_SOURCE_TOKEN` workaround, simply use `LOGTAIL_SOURCE_TOKEN` instead (without the `NEXT_PUBLIC_` prefix).

## Technical Details

**Logging Token Scope Change:**

* Previous: Accepted both `LOGTAIL_SOURCE_TOKEN` (server) and `NEXT_PUBLIC_LOGTAIL_SOURCE_TOKEN` (browser — bad practice)
* Current: Accepts only `LOGTAIL_SOURCE_TOKEN` (server)
* Impact: 🟢 No production impact if using recommended configuration

**MCP Testing:**
The replay harness now validates every schema hardening fix against live MCP transport, not just unit tests. This proved invaluable when the `reward_allocations` `operation` field fix was tested — three consecutive real chat sessions passed by chance, but the replay harness caught the regression instantly.

## Contributors

<CardGroup cols={4}>
  <Card>
    <img src="https://github.com/dch@wenudj.com.png" alt="dch" style={{borderRadius: '50%', width: 48}} />

    **@dch**

    2 commits • +166/-70 lines
  </Card>

  <Card>
    <img src="https://github.com/jamescockayne.png" alt="jamescockayne" style={{borderRadius: '50%', width: 48}} />

    **@jamescockayne**

    1 commit • +14/-16 lines
  </Card>

  <Card>
    <img src="https://github.com/nudj-changelog-bot[bot].png" alt="changelog-bot" style={{borderRadius: '50%', width: 48}} />

    **@nudj-changelog-bot**

    1 commit • Documentation sync
  </Card>
</CardGroup>

## Release Stats

| Metric        | Value    |
| ------------- | -------- |
| Total Commits | 4        |
| Lines Added   | +372     |
| Lines Removed | -87      |
| Files Changed | 15       |
| Release Size  | 🔵 Small |
| Complexity    | ⭐ Simple |

## Known Items

* This release contains no breaking changes
* Logging token configuration uses `LOGTAIL_SOURCE_TOKEN` (not `NEXT_PUBLIC_*`)
* MCP regression testing is deterministic and runs on every deployment

***

*v2.453.16 deployed on July 20, 2026*