What's shipped

Small, focused release on top of v0.26. Closes the loop by making the marketplace API keys usable from the CLI without opening a browser.

• `railcall market api-keys list|create|revoke`
  Three verbs, direct mappings of the web-UI surface at /marketplace/settings/api-keys. Fresh secret prints ONCE to stdout on create — matches the web UI's one-shot banner.
• `RAILCALL_API_KEY` env var precedence
  Every marketplace-authed command checks the env var first, falls back to interactive session only when unset. Set it in your CI/CD runner and every command works headlessly. Rejected key does NOT silently downgrade to the session — that would mask credential misconfigs.
• Lateral-privilege guard on api-keys management
  An API key can't mint or revoke other API keys — that would be a lateral privilege loop. The CLI detects RAILCALL_API_KEY on api-keys subcommands and refuses with an actionable message pointing at `railcall market login` OR the web UI.

The most significant single release since v0.22 (marketplace/modules launch). First cut where a team-sized customer can honestly buy Enterprise: log in with their identity provider, auto-provision + auto-remove users, assign roles across their team, publish modules only their team sees, stream every signed receipt to a shared vault they control.

• WorkOS SSO
  SAML/OIDC — Okta, Azure AD, Google Workspace, Ping. Enterprise buyer types their domain at /marketplace/sso, browser bounces through their IdP, JIT-provisions User + Membership + mints the same JWT the password flow issues.
• Multi-seat + RBAC (5 roles)
  viewer / operator / publisher / admin / owner. Higher role implicitly grants every lower one. Last-owner protection prevents an org from becoming ownerless via demotion or removal.
• SCIM Directory Sync
  WorkOS webhook handler. When the customer's IdP flips a user, we mirror it: JIT-create Membership, sync attributes, mark removed_at on delete. Group→role mapping via Organization.dir_group_role_map (admin configures at /marketplace/org/dir-role-map).
• Configurable receipt vault (4 drivers)
  local (filesystem path — covers external SSD, NAS mount, USB) · s3 (hand-rolled AWS SigV4, zero deps, works with AWS S3, MinIO, R2, GCS) · network_share (SMB/NFS) · custom (importlib loader for user-supplied Python drivers). Secrets never in the marketplace DB — configured as env:/file:/keyring: references.
• Air-gap install kit
  Self-contained tarball (railcall_airgap_v0.26.tar.gz) with every file + governance ruleset + station bundle + MANIFEST.txt sha256 + verify.sh. Move to network-isolated host, run verify.sh, then install.sh. No outbound at install OR runtime.
• Session invalidation on removal + role demotion
  AuthService.invalidateAllSessions bumps user.session_generation and revokes every un-revoked refresh token in one transaction. Max window from 'you're fired' to 'your JWT stops working' is 15 min — access-TTL grace.
• Admin audit log
  OrgAuditLog append-only table. Every admin-scoped mutation writes here — member invited/role_changed/removed, vault config changed, SCIM events, subscription activated. Owner+ view at /marketplace/org/audit with event-slug filter + keyset pagination.
• Long-lived API keys (rc_ak_live_*)
  Web UI at /marketplace/settings/api-keys — sha256 stored, per-key scopes, one-shot display on create. Wired into POST /listings (canonical CI/CD use case: headless module publishing).
• Team-tier billing
  $100/seat/mo, min 2 seats, 14-day free trial. Self-serve Stripe Checkout at /marketplace/org/billing. Real live-mode subscription pointed at real license-mint service.
• GDPR Art. 20 org data export
  GET /org/export dumps organization + members + invitations + org-owned listings + 500 most recent audit lines as JSON. Owner-only. Recorded in the audit log itself.
• /trust/subprocessors + /status
  Public per-vendor list of every third party that touches customer data (Render, WorkOS, Stripe, Resend, GitHub, Cloudflare) with data categories, jurisdictions, and 30-day new-vendor notification commitment. Live client-side probes of railcall.ai + marketplace API at /status.

Pragmatic module sandboxing: only pubkeys on our maintained allowlist can publish workflow/module types. Full subprocess sandbox (Phase 4b) deferred; the allowlist covers 100% of the risk at 5% of the implementation cost.

• Trust allowlist enforcement
  listings.publish refuses if the publisher_pubkey isn't on the allowlist. Sami's pubkey (726b327ec6…) is on it; new sellers need staff approval before publishing.
• HIPAA trust page
  /trust/hipaa — technical safeguards map (§164.312), BAA scope, our HIPAA position. Compliance still lives in your posture; the evidence artifacts your auditor asks for ship with the base install regardless of tier.

The full buy → install → run loop for paid modules — from prominent buy CTAs on the storefront to a dashboard 'claim your license' block to Studio-side modal that walks a user through activation.

• Studio Licenses tab
  Visual license management inside the Studio. See what's activated, when licenses renew, revoke stale entitlements.
• Auto-claim: install_pubkey linking
  Account-linked install pubkey triggers automatic license mint after purchase. Buyer clicks 'Install' in the Studio; no manual license entry required.
• Stripe Billing Portal for buyers
  Buyer self-service for subscription management (cancel, change payment method, download invoices) via Stripe's hosted portal — no code we maintain.

Every paid module gets a per-install Ed25519-signed license bound to the buyer's install pubkey. Studio's module loader refuses to load a paid module without a valid license. License mint runs on a separate Render deploy so a marketplace compromise can't leak the signing seed.

• Module license primitive
  module_entitlement in the loader — the ONE audited verify/install path. CLI never reimplements verification.
• `railcall license` CLI
  activate / list / verify subcommands.
• Salesforce module Pack A ($199/mo)
  First real paid CRM module — 13 core CRM commands + OAuth refresh + signed per-install license.

Signed handler bundles that add new airlock commands. Publishers can now ship real capability (not just workflow templates) through the marketplace. The wedge that seeds supply and demand on the platform side.

• Module loader
  Signed bundles installed to ~/.railcall/station/modules/<slug>/. Handler manifests describe commands, auth patterns, provider requirements.
• 5 launch modules
  local.csv_append, Discord, Notion, GitHub, Webhook — spanning the 5 auth patterns modules need to support (none, bot-token, oauth, api-key, signature).
• Modules browse + management surfaces
  Marketplace section for browsing modules with trust indicators; Studio sidebar tab for managing installed modules.
• Publish flow live
  Sellers can register a publisher pubkey + publish signed modules through the CLI or marketplace API.
• railcall/hubspot module
  First real CRM reference implementation shipped free — for buyers to see what a full-featured module looks like before they buy the paid Salesforce module.