1.0.1

What's Changed

1.0.1 is a small patch release follow-up to the recent 1.0 release. It mostly consists of bug fixes, small improvements for flexibility, and updates to the documentation and project/release management.

Bug fixes

• [Bug] Fix label expiry checks on reasons by @jeffhalmich in #149
• Add safeparse to string udfs by @cmttt in #125

Enhancements

• configurable execution result store by @haileyok in #29
• Add error_on_empty parameter to HasLabel UDF by @cmttt in #128
• Support Optional types in comparison operators (<, >, <=, >=) by @alphonsoc in #146

Improved docs

• docs: mention documentation guidelines by @cassidyjames in #133
• docs: Add adopters with logos to README by @cassidyjames in #137
• docs: Add screenshots for suspicious user detection by @julietshen in #138
• update/add to rules documentation by @haileyok in #145

Project/release management

• [Docs] add bootstrap release policy and CHANGELOG by @juanmrad in #152
• CODEOWNERS: add ROOSTers and Discord teams by @cassidyjames in #150
• CODEOWNERS: Fix * owners by @cassidyjames in #151
• [CI] Fix code-quality workflow due to missing package index update by @juanmrad in #153

New Contributors

• @alphonsoc made their first contribution in #146
• @jeffhalmich made their first contribution in #149
• @juanmrad made their first contribution in #152

Full Changelog: 1.0...1.0.1

1.0

Osprey is an open-source rules engine for trust and safety operations, currently running in production at Discord and Bluesky, processing 45M-61M events daily at Bluesky alone. v1 expands the open-source release to include more of the infrastructure that powers those deployments, so teams adopting Osprey can run it in production without rebuilding these pieces themselves.

This release adds three major features: a flexible labeling service, a Rust-based coordinator for horizontal scaling, and a real-time event stream for investigations. As part of making it easier to get started with Osprey with this release, we now build the documentation into a searchable website: https://roostorg.github.io/osprey/

Labeling Service

Added a labeling service to Osprey: a pluggable subsystem for attaching human and automated labels to any entity (users, IPs, emails, etc.). Labels feed into the rules engine and UI to improve detection and workflow.

• Manual labeling in the UI (positive/negative/neutral) for Safety teams to annotate entities
• Programmatic label mutations produced by rule executions are persisted by the labels service
• Pluggable backend: implement LabelsServiceBase or provide a LabelsProvider to support different storage backends (Postgres plugin included)
• Atomic read-modify-write context for safe concurrent updates and retries
• Batch reads supported for performance during rule execution
• Conflict resolution: simultaneous or contradictory mutations are resolved by status priority; dropped mutations are reported back
• Rich label model: statuses (automatic vs manual), reasons (descriptions, features, created/expires), previous states, and label connotation (positive/negative/neutral)

Coordinator

Introduced the Osprey Coordinator: a Rust-based action distribution and load-balancing service that centralizes action ingestion and routes work to Osprey workers for reliable horizontal scaling.

• Central action hub: accepts actions from Kafka/PubSub or directly via gRPC (bidirectional streaming and synchronous API)
• Load balancing and prioritization: maintains a priority queue (sync vs async) and routes actions to workers based on priority and hashring/discovery logic
• Reliable delivery: tracks outstanding actions, acknowledgements, and retries to ensure dependable processing
• Service discovery: integrates with etcd so workers and coordinators can discover each other for scalable deployments
• Metrics and observability: emits coordinator metrics to monitor throughput, latencies, and health
• Pluggable deployment: runs as a separate service (Rust binary and Dockerfile); included docker-compose example and startup flags to enable the coordinator
• Works with existing worker model: workers connect to the coordinator using long-lived gRPC streams to receive assigned actions

Event Stream

Added the Event Stream: a real-time, searchable investigation feed in the Osprey UI that surfaces events, rule verdicts, and extracted features to speed investigations and monitoring.

• Live feed for real-time event monitoring and operator investigations
• Searchable historical events using SML queries for ad-hoc investigations and pattern discovery
• Built-in visibility into rule execution results and extracted features beside each event
• Configurable presentation: card vs list views and user-selectable summary features
• Improved integration with analytics and sinks so event metadata and classification data populate the stream
• UI components and APIs included to support deep dives (event detail pages and feature location endpoints)

Contributors

Thanks to @EXBreder, @BinaryFiddler, @elijaharita, @caidanw, @jaredmiller13, @haileyok, @cmttt, @ryanprior, @ThisIsMissEm, and @julietshen for their continued contributions to Osprey, and welcome to our new contributors:

New Contributors

• @annebdh made their first contribution in #66
• @bmuenzenmeyer made their first contribution in #93
• @cassidyjames made their first contribution in #97
• @rashmiraghunandan made their first contribution in #101
• @vinaysrao1 made their first contribution in #120

Full Changelog: 0.1...1.0

0.2

This release includes an asset for the osprey_rpc library.

0.1

Release pre-coordinator integration.

Note from @cassidyjames: Effectively the same feature-wise as the upcoming 1.0 release, but 1.0 will include coordinator integration and any other upstreamed improvements from the reintegration of Osprey into internal Discord tools.