v2.2.0: LLM Proxy, Self-Service Signup, Skills System

The biggest STOA release yet — 1,091 commits, 297 features, and a fundamental shift toward AI-native API management.

Highlights

LLM Proxy & Cost Management

• Multi-provider LLM routing (OpenAI, Azure OpenAI, Mistral) with subscription-aware namespace selection
• Per-tenant budget tracking with enforcement and circuit breakers
• Anthropic cache token tracking for cost optimization
• Dedicated LLM token tracking Grafana dashboard

Self-Service Signup

• End-to-end tenant provisioning flow: portal signup page, API provisioning endpoint, trial limits enforcement
• Demo tenant automation for onboarding
• Seed data for Chat Completions API with 2 subscription plans

MCP Protocol 2025-11-25

• Upgraded protocol with resources, prompts, and completion REST endpoints
• Lazy MCP discovery with cache-first pattern
• Tool schema validation at registration time
• MCP spec compliance methods

OAuth 2.1 Hardening

• DPoP proof-of-possession binding (sender-constraint middleware)
• RFC 7592 DCR management endpoints
• Proxy hardening with circuit breaker + retry for OAuth and Control Plane calls

Skills System

• Gateway-native skills CRUD with circuit breaker health tracking
• Lazy MCP discovery integration
• Tool schema validation at registration

UAC (Universal API Contract)

• JSON Schema v1.0 validator library
• OpenAPI reverse transform with round-trip conversion tests
• LLM contract types for UAC binding

---

Gateway (Rust)

Capability	Description
LLM Proxy	Multi-provider routing (OpenAI, Azure, Mistral) with cost tracking and circuit breaker
Skills System	CRUD operations with circuit breaker health tracking
MCP 2025-11-25	Resources, prompts, completion endpoints, lazy discovery
DPoP	Sender-constraint middleware for token binding
DCR Management	RFC 7592 endpoints
W3C Traceparent	Propagation through proxy hops
Arena Enterprise	20-dimension benchmark across 4 categories

Control Plane API (Python/FastAPI)

12 new endpoints:

Method	Path	Description
POST	/v1/tenants/provision	Self-service tenant provisioning
POST	/v1/tenants/export	Tenant export for disaster recovery
POST	/v1/tenants/import	Tenant import/restore
GET/POST	/v1/billing/budgets	LLM budget service + provider config
GET/POST	/v1/billing/consumers	Billing consumer CRUD
GET/POST	/v1/billing/models	Billing models + budget check
GET/POST	/v1/contracts	Contract lifecycle management
GET/POST	/v1/data-governance	Data governance endpoints
GET/POST	/v1/pii	PII masking middleware + admin endpoints
GET	/v1/security/posture	Security posture scanner
GET	/v1/system/info	System info with edition/licensing
POST	/v1/signup	Self-service signup

Additional improvements:

• UAC v1.0 JSON Schema validator with OpenAPI reverse transform
• SCIM-to-Gateway reconciliation service
• PG audit trail with dual-write pattern
• Usage metering pipeline

Console UI (React/TypeScript)

• Permission gates with PermissionGate component + Proxy Owner dashboard
• LLM Cost Management dashboard with per-tenant budget visualization
• Access Review dashboard for compliance workflows
• Security Posture dashboard with token binding status
• Live deployment dashboard with SSE logs and step progress
• i18n framework with react-i18next (39+ strings extracted)
• Floating AI assistant chat widget

Developer Portal (React/TypeScript)

• Self-service signup page
• Chat Completions API enrichment panel with subscription flow
• Unified Marketplace page
• Execution taxonomy filters with 4-persona test coverage
• MCP Developer Self-Service with tenant-scoped servers
• Guided onboarding wizard
• RBAC-aware widget visibility

Gateway Adapters

New adapter support:

• AWS API Gateway — API Proxy CRUD, Product quotas, Developer App management
• Azure APIM — ARM REST API integration with XML policy support

Existing adapters enhanced:

• Apigee X — Application support, idempotent developer creation
• Kong — DB-less declarative config improvements
• Gravitee — V4 API lifecycle support

Helm Chart

New values:

Key	Default	Description
stoaGateway.llmProxy.enabled	false	Enable LLM proxy routing
stoaGateway.llmProxy.providers	[]	LLM provider configurations
stoaGateway.skills.enabled	false	Enable skills system
arena.enterprise.enabled	false	Enable enterprise arena CronJob

Infrastructure

• Gateway Arena Enterprise Layer — 20-dimension benchmark with CI95 confidence intervals
• Platform Continuous Verification (L2) — 3 CUJs every 15 minutes
• Keycloak 26.5.3 upgrade
• SCIM protocol mapper + DCR onboarding API

Security

• DPoP proof-of-possession (RFC 9449)
• PII masking middleware with admin endpoints
• Security posture scanner service
• Data governance endpoints

---

Breaking Changes

None. All new features are opt-in via Helm values or API configuration.

Known Issues

• Gateway Shadow Mode not yet implemented (planned Q4 2026)
• Terraform Provider in planning phase

Upgrade Guide

# Helm upgrade
helm repo update stoa
helm upgrade stoa-platform stoa/stoa-platform -n stoa-system

# Verify
kubectl get pods -n stoa-system
curl https://api.<YOUR_DOMAIN>/health

For detailed upgrade verification, see the upgrade verification script.

What's Next

See our Roadmap for upcoming plans:

• Gateway Sidecar Mode — coexist with Kong, Envoy, and existing gateways
• GitOps Reconciliation Operator (replacing AWX)
• stoactl CLI tool (Go/Cobra)
• Gateway Proxy Mode and Shadow Mode

Resources

• Documentation
• GitHub
• Full Changelog
• Discord

---

The STOA Team