Upgrade notes
The sigHeader note
Section titled “The sigHeader note”The firewall signs the X-RG-* headers it sends to your origin (X-RG-Sig) only when both are true: the policy bundle has sigHeader: true and the integration has a sigSecret. If the bundle asks for a signature and no secret is configured, the integration logs config-warning:sig-secret-missing once and signs nothing. Without a signature those headers are advisory: set a sigSecret in every integration before you turn sigHeader on, and verify the signature at your origin.
The disabled kill switch
Section titled “The disabled kill switch”The policy bundle can carry an optional disabled: true (the owner’s emergency switch in Firewall settings). A verified bundle with it makes the integration allow every request. Integrations older than this change accept the field but keep enforcing, so upgrade every integration before you rely on the switch.
Versioning
Section titled “Versioning”Error codes and reason codes are append-only. A client must tolerate codes it does not know. The SDKs follow the protocol version in the reference.