Status & versions

Release timeline

Every tagged release in the current lineage, newest first.

1. v0.5.02026-11-03 · minor

   Remote sources, schema guard, production stack. Remote OGC API — Features (Core) and remote GeoJSON URL ingestion with per-load caps and ephemeral credentials; schema readiness guard + PreSync migrations; About page; website and GitOps integrated; 95 MiB upload cap.

2. v0.4.32026-11-02 · patch

   Dev-hostname patch. Deployment-only patch: dev build arguments use dev-api.locateflow.xyz and the release lineage is folded into the v0.4.2 homelab deployment.

3. v0.4.22026-11-02 · patch

   Homelab deployment (I1). First release deployed to the homelab: one container image per deployable, k3s namespace layout, external PostGIS, Cloudflare Tunnel, and deployment documentation.

4. v0.4.12026-10-27 · patch

   License-term enforcement. License spatial, temporal, and feature-count caps are enforced by featureflow through the existing CQL2/page machinery; spatial terms accept a polygonal GeoJSON FeatureCollection.

5. v0.4.02026-10-26 · minor

   Discovery + catalogue portal (P2.0). Public metadata listings, scoped discovery views, mediated offers, OAuth2 machine clients, signup opt-down, and the /portal + /discovery UI. A listing never grants access.

6. v0.3.02026-10-23 · minor

   Multi-tenant SaaS (P1c). Ownership, publishing, licensing, API keys, Keycloak identity, gateway PEP + permission-service PDP, Redis quotas, append-only usage/audit log, and the admin UI.

7. v0.2.02026-10-09 · minor

   P1a hardening. Hardening and correctness across the serving and onboarding paths after the P0 slice.

8. v0.1.02026-10-05 · minor

   P0 serving slice. OGC API — Features Core + Part 3 Filtering/CQL2, bbox and datetime filters, keyset pagination, and STAC-compliant PostGIS storage.

Version matrix

Repository versions are shown for the released tag and the currentdevelop line. The site does not present develop versions as released.

What is live

These capabilities are released and available on the production hosts. They are not a claim that every roadmap item is complete.

• Load. WFS 1.x/2.x, GeoJSON, Shapefile, remote OGC API — Features (Core) and remote GeoJSON URL (0.5.0). CSV/DBF is specified.
• Serve. OGC API — Features Core + Part 3 Filtering/CQL2, bbox/datetime, keyset pagination.
• Control. Ownership, visibility, capabilities, quotas, suspension, and append-only audit on one PEP/PDP path.
• License. Per-collection spatial, temporal, feature-count, and request-quota terms; time-bound and revocable.
• Discover. Public metadata listings and scoped discovery views. A listing never grants access.

What is in development

The remote-source slice adds remote OGC API — Features (Core) and remote GeoJSON URL sources. P1 and P2 are merged on develop; P3 API wiring is in progress.

What is specified, not built

• Commerce. Pricing, quotes, orders, invoices, and payouts are specified in ADR-0053/0054/0055; no implementation on develop.

What is planned

• Scale. H3, externalized properties, partitions, and the performance component are the last feature phase.
• Viewer app. Metadata viewer and aggregation CRS work are P3.
• AI assistant. Natural language to CQL2 is P4.
• OGC certification. The internal conformance suite covers Core + Part 3. Official certification is the final roadmap item.

Known limitations

• No official OGC certification. The internal suite covers Core + Part 3 Filtering; certification is the final roadmap item.
• WFS GML responses are not implemented. WFS ingestion expects a GeoJSON response; a GML-only server fails with a fixed limitation label.
• No commerce implementation. Pricing, orders, invoices, and payouts are specified in ADR-0053/0054/0055.
• No performance automation yet. H3, externalized properties, and partitions are the last feature phase.
• No viewer or AI assistant. The metadata viewer is P3; natural-language CQL2 is P4.
• No anonymous feature data. Public listings are metadata only; data always needs a tenant entitlement.

How this page is verified

Snapshot 2026-11-02. Derived from the LocateFlow decision log and product repositories. The production hosts were verified in the v0.5.0 release record:

• app.locateflow.xyz — SPA, 200
• api.locateflow.xyz/health — 200
• auth.locateflow.xyz — OIDC discovery 200 for both realms
• locateflow.xyz — institutional website, 200 (www → apex redirect)

A machine-readable snapshot is available at/status.json. It is generated from the same data module as this page and can be regenerated when a release is cut.