Week of July 5–11, 2026

This week at a glance

A focused RouteShift release week. Employees at a Google Workspace or Okta org can now sign in to the RouteShift CLI with real SSO and get a short-lived, self-service virtual key — no admin has to mint or share credentials. Live web search is now available as a per-request plugin — opt in with a :online model suffix or an explicit plugins array and RouteShift attaches fresh search results to the prompt without your client wiring a second API. Credit accounting is now reserved before dispatch on every credits-mode path (closing a concurrent-overspend window), the circuit breaker gained an optional percentage-based trip mode, and reasoning-effort and thinking-budget controls became first-class routing-rule fields that also participate in the response cache. A new weekly cron flags newly-released models for human review instead of silently adding them to the catalog, so surprise auto-routing doesn't happen. Codex also published six new research-tier datasets on Hugging Face.

New features

• RouteShift: Native SSO device-flow login for the connect CLI. A teammate at a Google Workspace or Okta org runs the CLI, receives an 8-character user code, approves it in their browser through the org's real IdP, and the CLI receives a short-lived (8-hour) self-service virtual key — no admin has to manually mint or share credentials, and every issuance is written to the workspace audit log with the SSO subject. Full RFC 8628 (OAuth 2.0 Device Authorization Grant) implementation. Provisioning is per-team via new IdP-config admin endpoints; the device flow is gated by SSO_DEVICE_FLOW_ENABLED and stays off until a team is onboarded. Rate limiting is keyed on the device code (not the client IP), so users behind shared or NAT'd IPs aren't falsely throttled.
• RouteShift: New web search plugin for any chat completion. Opt in per request with a :online model suffix or an explicit plugins: [{ id: "web", ... }] entry, and RouteShift queries a search backend, formats the top results as a clearly labeled context block, appends them to the system prompt, and forwards to the upstream provider — the model sees titles, URLs, and snippets, and never sees a raw plugins field. Augmented turns are non-cacheable so time-sensitive results are never replayed, and callers who mark the plugin required: true get a clean plugin_required_failed on backend failure instead of a silently un-augmented response. See the July 10 daily entry.
• Codex: Six new research-tier datasets on the Axiom AI Hugging Face organization — AIS Maritime, Civic Intelligence — Events Timeline, OSHA Safety, LEHD Commuter Flows, POI Intelligence, and Permit Signals. Each is a deterministic 100K-record stratified sample in Parquet under CC-BY-4.0, shipped with a README, schema documentation, and the standard APRS envelope. See the July 9 daily entry.
• RouteShift: reasoning_effort and thinking_budget_tokens are now modifiable routing-rule fields — a rule can dial reasoning effort or extended-thinking budget up or down per match without the client changing anything. Both fields are also part of the response cache key, so a high-effort call and a low-effort call to the same prompt no longer collide on a cache hit.
• RouteShift: The circuit breaker on load-balanced provider keys gained an optional percentage-based trip mode — instead of tripping on a raw count of 5xx/429, a credential can be parked when its error rate crosses a threshold within a sliding window. Useful for noisy multi-region setups where a few isolated failures shouldn't take a key out of rotation.
• RouteShift: New model-drift detection cron runs weekly and proposes newly-released models as parked catalog entries — never auto-routed — so a human reviews and approves a new model before any traffic can land on it. Pairs with the existing weekly pricing sync.
• RouteShift: Weekly pricing sync coverage extended to more providers, so newly-released models and provider price drops propagate into routing decisions and analytics without manual data entry.
• RouteShift: Preset version history is now visible in the dashboard. Every edit to a named preset already produced an immutable snapshot; two new team-scoped read endpoints let the dashboard list past versions (newest first) and open any single revision with its model, params, system prompt, provider preferences, author, and timestamp — useful for diffing a working preset against last week's known-good version, or copying a field back after a bad edit. Cross-team lookups return the same preset_not_found response as missing presets. See the July 10 daily entry.

Updates

• RouteShift: Credit reservation now happens before the upstream request dispatches on every credits-mode path. Previously the pre-flight check was advisory, so two concurrent large requests from the same key could both pass, each read a stale balance, and dispatch — leaving the workspace briefly negative. Reservations are now the source of truth: concurrent requests contend on the reservation, and one is rejected cleanly instead of both completing on borrowed balance.
• RouteShift: Response cache invalidation on provider-key rotation. When you rotate an upstream credential in Providers, cached responses tied to the old credential are dropped, so a rotated-out key can never resurface content on a cache hit.
• RouteShift: Billing-mode changes (switching between credits mode and the standard 3% savings-share) now invalidate the cached billing-mode read at the same time, so a mode change takes effect on the next request instead of the next cache refresh.
• RouteShift: Dispute reinstatement is now symmetric — a Stripe chargeback dispute that resolves in your favor restores credits to the same ledger balance the debit originally came from, matching the debit path exactly. No lost or duplicated credits when a disputed charge reverses.
• RouteShift: An operator-funded prompt-optimizer spend cap now bounds RouteShift's own Optimize analysis calls per workspace, so the optimizer can't drift into an expensive loop against a single tenant.
• RouteShift: Sentry alert on missing-pricing gaps outside credits mode — if a request lands on a model whose pricing catalog entry is missing, on-call sees it immediately instead of silent zero-cost accounting.

Fixes

• RouteShift: Streaming settle-failure no longer refunds already-delivered content. If the credit-settlement write failed after tokens were already streamed to the client, the previous code would refund the full request as if it hadn't been served. Settlement now distinguishes delivery from settlement so a partial failure only refunds what wasn't received.
• RouteShift: Auto-topup webhook backfill for a worker-crash window. If the auto-topup worker crashed between charging Stripe and stamping the workspace, the next run could double-charge or skip topups entirely. Backfill now reconciles Stripe against ledger state on restart and stamps the cooldown timestamp so no window is retried twice.
• RouteShift: Cache-write TTL bug fixed — some response-cache writes were landing with a 1-hour TTL instead of the configured value, causing early misses on long-lived entries. Writes now use the configured TTL end-to-end.
• RouteShift: custom-condition routing rules now fail closed. Previously a custom-condition rule with a malformed or missing predicate was silently matching every request (fail-open); it now rejects the malformed rule at save time and never matches at runtime.
• RouteShift: keyHasReadScope gate closes a usage and generation-lookup scope-bypass. A read-scoped virtual key can no longer reach admin-usage endpoints intended for full-scope keys.
• RouteShift: Team-invitation accept race fixed — accepting a team invitation twice (double-click, refresh) can no longer produce a duplicate membership row or wedge the accept flow.
• RouteShift: connect --tool claude-code config-safety fix — the local connect CLI no longer overwrites an existing tool config file when re-run against the same tool; it merges or prompts instead.
• RouteShift: Preset write responses (create, update, disable, delete) now report an explicit proxy_cache_invalidated flag — and, on failure, proxy_cache_error: "proxy_cache_invalidation_failed" plus cache_ttl_seconds. The database write is still committed, but callers now see when the proxy's preset cache invalidation didn't land, instead of the previous silent success. See the July 10 daily entry.
• Codex: The Chicago building-inspection records dataset now carries the correct source_uri on every row — a backfill previously left 3,671 rows with an empty source URL and 628 more with no envelope at all; all 4,299 rows now point at their real Chicago Socrata source, and the daily cron that keeps this dataset current has been restored. See the July 9 daily entry.
• Overwatch: The analytical charts on Forecasts, Estimates, Fleet (age histogram and age-trend), Berth utilization, seasonality panels, the ownership-graph visualizations, and the Locus score-history panel on the locus-validation view render cleanly during layout transitions. Three earlier passes had guarded the terminal-panel charts against a Recharts zero-dimension render warning, but ten chart surfaces elsewhere in the app were still unguarded and could briefly render at negative width or height (or flash a console warning) whenever their container measured before layout settled. Every chart surface is now guarded uniformly, and a repository-wide check prevents new charts from regressing. See the July 9 daily entry.
• Layer: Google sign-in restored. New and returning users signing in through Google Workspace via Auth0 Universal Login reach the Layer app cleanly again — an internal token-verification mismatch had been rejecting valid Google magic-link callbacks with a "one-time token not found" error. Existing sessions were unaffected; no action is required on your part.
• Locus: The nightly HMDA multifamily ingest is safe against an upstream CFPB API regression. The public HMDA endpoint silently stopped honoring the property_types=3 server-side filter on 2026-07-01, which would have pulled 15–45× the expected volume per state into the multifamily loan-records table on the next scheduled run. The collector now filters multifamily loans client-side, enforces a per-state ceiling that fails loudly instead of over-ingesting, and streams the CSV response so a full state pull can't exhaust worker memory. As a bonus, rows now carry the correct property_type value they'd been silently missing since the loader was written, so multifamily and construction loan counts in the derived aggregates are populated for the first time. See the July 10 daily entry.