> ## Documentation Index
> Fetch the complete documentation index at: https://oxy.tech/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Partner Distribution Platform, Local Custom-App Development, and Data Freshness Awareness

> A partner tier for custom apps, local development against live cloud data, and freshness-aware analytics agents.

<Icon icon="calendar" iconType="regular" size={16} /> **July 18, 2026** · v0.5.107 – v0.5.110

### New Features

#### Partner Distribution Platform

A new **Partner** tier sits between everyday users and Oxy staff, giving partners a scoped, self-service way to manage the orgs and custom apps they distribute — without ever gaining full platform reach.

* **Partner accounts** - A partner owns a set of downstream orgs and administers them through a capability-gated surface, so its reach is limited to exactly what it was granted rather than a synthetic org membership.
* **Scoped delegated admin** - Partners manage members (invite, change role, remove — with an owner-seizure guardrail) and publish or unpublish custom apps for the orgs they own, all from a dedicated partner console with Orgs, Members, and Audit tabs.
* **Append-only audit log** - Every partner action is recorded to a tamper-evident, per-org audit trail, so who did what across managed orgs is always accountable and reviewable.

Alongside this, user-facing copy now consistently says **"custom app"** in place of "customer app."

#### Local Custom-App Development with `oxy proxy`

Develop a custom app on your laptop while it talks to a real cloud Oxy — the same experience as `vercel dev`, but for Oxy.

* **`oxy proxy --env <env>`** - Runs a local sidecar that stands in for `oxy serve` and forwards data-plane calls to your chosen cloud environment using your existing `oxy login` session, so queries, streamed results, and large payloads all work against live data.
* **Safe by default** - Analytics/tracking events are dropped, side-effecting function and agent calls are held, and pushing against production requires an explicit confirmation — so local iteration can't accidentally mutate a live environment. Your auth token never leaves the local process.
* **Wired into the dev server** - The Vite dev plugin proxies function (`/fn`) calls through the sidecar, so a custom app under local development behaves the same as one served by Oxy.

#### Freshness-Aware Analytics Agents

Analytics agents now understand how current your warehouse data actually is, so they stop treating a partly-loaded day as final or reporting "no rows loaded" as a real zero.

* **Per-source coverage** - Every agent prompt now carries a coverage summary (e.g. "sales through Jul 17, delivery through Jun 30"), so the agent scopes recent-edge questions to the data that actually exists.
* **On-demand freshness checks** - A new `check_data_freshness` capability lets the agent probe a specific view's latest loaded date mid-query when it needs to.
* **Honest answer boundaries** - When a question reaches past the data that's loaded, the answer now states `data covers through <date>` instead of silently under-reporting a range as complete.
* **Declared freshness contracts** - A view's `meta:` freshness settings (watermark column, expected cadence, and caveats) are now honored end-to-end and surfaced to the agent, so a workspace no longer needs a hand-rolled freshness polyfill.

#### Email from Oxy Functions

Oxy Functions running inside a custom app can now send email directly, backed by Oxy's managed sending infrastructure.

* **`ctx.email.send`** - Send transactional email (to/cc/bcc, subject, HTML body, and a custom reply-to) from a function, gated behind an explicit `email: { send: true }` capability in the app manifest.
* **Preact email templates** - A new `@oxy-hq/sdk/email` export renders preact components to HTML with `render(Component, props)`, so you can build typed, reusable email templates that run in the Functions runtime.
* **Managed sender** - Oxy controls the verified `from` address and enforces a per-send recipient cap; your function chooses recipients and an optional reply-to. In local development the rendered email previews in the browser instead of sending, so you can iterate without touching a real mailbox.

#### Airway Automation Task

Automations can now run an Airway ELT pipeline as a step, so ingest and the transforms that depend on it live in one ordered `.automation.yml` instead of separate, unsynchronized schedules.

* **`type: airway` task** - Point a task at an `.airway.yml` pipeline (with an optional resource subset) and it runs on the same durable path as scheduled Airway runs — reusing secret resolution, credentials, and backfill windowing.
* **Ordered ingest-then-transform** - Because tasks run in sequence, a downstream `execute_sql` rollup can safely read a table only after the pipeline that loads it has finished. A failed end-of-load fold now fails the run, so a rollup step can never read a half-loaded table.

#### OpenAI-Compatible Model Provider

Oxy can now route to any OpenAI-compatible gateway — LangDock, self-hosted proxies, or an EU/GDPR endpoint — while still resolving the API key from your workspace secret store.

* **`vendor: openai_compat`** - A new first-class model vendor that calls the Chat Completions API and pulls its key from the secret store via `key_var`, with a required explicit `api_url` so EU/GDPR traffic never silently routes to OpenAI.
* **Explicit vendor override** - `llm.vendor` now takes precedence over the vendor inherited from a referenced model, so you can point an existing model at a compatible gateway without redefining it.

#### Reusable Oxygen Shell in the SDK

The Oxygen shell is now published from `@oxy-hq/sdk/shell`, so a custom app can render Oxy's own chrome instead of rebuilding it.

* **Shell primitives** - `OxyShell`, the Ask dock, reasoning trace, native ECharts charts, and the icon rail + top-bar primitives ship as reusable components.
* **Wired into the scaffold** - The `create-oxy-app` Vite template now renders the shell by default, so new apps start with Oxy's layout and navigation out of the box.

#### Custom Apps from Any Origin

The Oxygen shell (`@oxy-hq/sdk` 2.5.0) can now be driven by a custom app served from **any origin**, not just one hosted same-origin with Oxy — so an externally hosted bundle gets the full wired shell and can match its own look.

* **Cross-origin backend access** - A `backendUrl` prop on the app provider points the SDK's data-plane requests at your cloud Oxy, so a bundle served from anywhere reaches queries, streamed results, and Ask Oxygen without a same-origin proxy.
* **Themeable chrome** - New chrome background/foreground props let a custom app color the icon rail, top bar, and Ask dock to match the host app's design.
* **Richer Ask Oxygen history** - The Ask dock history panel now lists past chats by title and relative time, keeps and highlights the active chat, and adds search and a "Show more" control for browsing longer histories.

***

### Platform Improvements

#### Security & Authorization

* **One unified authorization model** - Every access decision across the product now flows through a single, exhaustive authorization model instead of scattered ad-hoc checks. Consolidating them surfaced and closed several latent access-control gaps — including partner access to another tenant's app data, billing access, and self-service permission edge cases — so who can do what is now consistent and enforced everywhere.
* **Global Owners reach the custom-app lifecycle** - A Global Owner who isn't also a Global Admin is no longer blocked from the custom-app management surfaces the junior operator tier already runs.

#### Camera Fleet Reliability

* **Dashboards stay up during ingest faults** - Camera dashboard reads (health summary, compliance, cost, logs, rollups) now run on the dedicated analytics pool, separate from hot edge ingest. A write-path incident can no longer take a healthy dashboard down with it.
* **Self-healing warehouse client** - If a tenant's background connection driver died unexpectedly, the camera client could keep serving a dead handle — failing every read with "connection closed" until the process restarted. Handles now detect a departed driver and rebuild on the next request, so the fleet recovers on its own instead of wedging for hours.
* **Poison ingest batches are quarantined** - A batch the warehouse permanently rejects is no longer retried forever. After a bounded number of consecutive rejections it is dropped with a clear error and the stream resumes, instead of jamming ingest and hammering the backend indefinitely.

#### Developer Experience

* **A starter app ships with `oxy seed`** - A fresh install now seeds an example custom app, so the home launcher has something on it out of the box and the custom-app serve path is exercised from the first run. `oxy seed --clear` cleanly removes seeded apps and their bundles.
* **`oxy test` is back** - The `oxy test` CLI command returns for `.test.yml` eval files, with its full flag surface (`--tag`, `--min-accuracy`, `--case`, `--format`, `--output-json`, and more), so agent eval suites can run from the terminal and CI again.

#### IDE

* **Branch-aware semantic surfaces** - The World Model graph, the semantic explorer's query runner, and the Metric Tree now respect the branch you've selected in the IDE instead of always reading the default branch. Switching branches re-fetches and renders that branch's semantic layer, and running an ad-hoc query against a view that only exists on your branch no longer fails with a misleading "No datasource found" error.
* **Trustworthy workspace sync status** - The compile/sync status badge no longer reports "Up to date" when the remote has moved on. It now compares what's actually being served against `origin`, shows the serving / origin / files commits separately, and falls back to an explicit "unverified" state when the remote tip is unknown. Content pulled or restored now automatically triggers a recompile so the running workspace stops serving stale config, pull results report the real outcome ("Pulled 3 commits" vs "Already up to date"), commit history is timestamped from the correct clock, and never-pushed commits are flagged with a "local only" chip.

#### Insights Inbox

* **Segments no longer read as duplicates** - A monitor that watches a measure across segments (via `group_by` or filters) produces one anomaly per segment. Each inbox row now carries a segment badge (e.g. `restaurant_id: loc-abc`) identifying exactly which slice fired, so two segments of the same measure and period are no longer indistinguishable rows. Chain-wide monitors show no badge.
* **Visible scan failures** - When a scan can't evaluate some monitors, the inbox now shows a dismissible banner naming each failed monitor and its error — instead of only a "2 failed" count with no indication of which or why. Failures from scheduled background scans are logged with the measure, segment, and error.

#### Reliability

* **Safer rolling worker deploys** - A background worker shut down during a rolling deploy now cleanly hands back the tasks it was holding instead of penalizing them, so a routine deploy can no longer dead-letter a healthy task or flip its workspace to "unhealthy." The admin Worker Fleet panel also now counts workers correctly rather than counting in-flight runs.