AltusPlatform API Migration Hardening – 02/23/2026

Release Notes: AltusPlatform API Migration Hardening (Production Readiness)

Release scope

• Strengthened API request logging lifecycle to prevent orphaned/incomplete log rows.
• Standardized auth behavior for me vs API-key routes.
• Improved site/users performance path and observability.
• Added migration compatibility cleanups in dependent plugins.
• Added operational scripts/tests for KPI tracking, null diagnostics, 404 caller inventory, and smoke checks.

Implemented changes

1. PR1 Logging lifecycle hardening
   • Start/finalize usage log is now threaded reliably through request lifecycle.
   • Finalization runs through normal dispatch and shutdown/fatal fallback paths.
   • Better handling for status/duration capture in non-happy paths.
   • Runtime and fatal-path verification tests added.
2. PR2 Auth contract alignment
   • /altus/v1/users/me/courses constrained to session-auth expectation.
   • /altus/v1/users/{contact_id}/courses established for API-key/server callers.
   • Clearer auth-mode mismatch behavior and docs/examples updated.
3. PR3 Performance + diagnostics
   • site/users endpoint contract and explain probes added.
   • Pagination/latency telemetry and diagnostics tooling strengthened.
   • KPI report now tracks status distribution, null lifecycle rows, and route timing slices.
4. PR4 Migration cleanups
   • AltusLearnLMS enrollment flow prefers contact-id endpoint for API-key mode.
   • Legacy fallback guarded to avoid incorrect /me use.
   • Altus AI Support enrollment status flow modernized to preferred contract with fallback.

Operational outcome (latest validation)

• Last 1h KPI: NULL status+duration = 0 / 101 (0.00%).
• Recent 15m buckets: no NULL spikes.
• No /users/me/courses 401 cluster.
• One 500 present from intentional fatal smoke route test.

---

Rollback Checklist (if needed)

1. Plugin rollback

• Revert altus-api plugin to pre-hardening tag/commit.
• Revert dependent plugin updates:
  • altuslearnlms
  • altus-ai-support

2. Disable new/diagnostic-only routes or smoke hooks

• Disable fatal-smoke/testing endpoints in production if they were enabled.

3. Script/tool rollback

• Keep scripts in place if harmless, or remove only if required by policy.
• If removing, retain at least KPI and null diagnostics scripts for incident triage.

4. Data rollback

• No mandatory schema-destructive changes required for this release.
• If optional indexes were added, they can be dropped with the paired drop script.

5. Post-rollback verification

Run:

• bash scripts/altus-api-log-kpi-report.sh 1
• bash scripts/altus-api-null-diagnostics.sh 1

Confirm:

• API availability normal
• No auth regression on critical routes
• No elevated 5xx/4xx trends

---

EBl handoff checklist

1. Promote the exact validated build artifacts for altus-api, altuslearnlms, and altus-ai-support.
2. Run post-deploy smoke:
   • bash scripts/altus-api-logging-smoke.sh
   • bash scripts/altus-api-log-kpi-report.sh 1
   • bash scripts/altus-api-null-diagnostics.sh 1
3. Capture KPI output snapshot for release evidence.
4. Monitor first hour for status mix, NULL rows, and /site/users latency.