What we shipped.

Changed: four plans, named after the outcome. The old names described how big you were. The new ones describe what you get:

• Silent Failure Audit — free, once per company. A 48-hour read-only assessment that gives you your silent-failure count, the failure taxonomy, and the top three offending steps. Yours to keep either way.
• Verify — $2,500 / month. Every claimed action checked against your database, on every run.
• Recover — $7,500 / month. Everything in Verify, plus the fix generated and re-run from the last checkpoint.
• Assure — from $15,000 / month. Everything in Recover, plus full audit lineage from failure to verified fix, unlimited workflows, custom retention, and a named support line to the founder. A verification SLA, a self-serve shareable report, SSO and an in-VPC collector are on the Assure roadmap and are marked as such on the pricing page — they have not shipped.

Annual is twelve months for the price of ten.

Why the rename. Seat-and-volume tiers price the size of the team. What a team is actually buying here is a level of proof: told, checked, or repaired. The plan you need is the one that matches how expensive a wrong write is to undo, and the names now say that out loud.

Note: earlier entries on this page refer to Free, Developer, Pro and Enterprise. Those were the plan names at the time and the entries are left as they were written.

Shipped: Outbound webhooks. Register HTTPS endpoints and subscribe to execution.completed, execution.failed, recovery.created, recovery.applied, billing.topup_completed, billing.quota_alert, and billing.subscription_updated. Every delivery is HMAC-signed (Stripe-shaped header X-Omium-Signature: t=…,v1=…), retried up to five times with exponential backoff, and recorded in a per-endpoint delivery log with response codes and error bodies.

Shipped: Workflow tab, rebuilt. When a run has no pinned workflow definition, the Workflow tab now derives a real graph from the trace spans — parent/child edges from the span tree, node kinds inferred from span_type, and statuses/durations/attributes overlaid on every node. The single-actor fallback is gone.

Shipped: Profile pictures. Google and GitHub sign-in users get their avatar automatically. Email-signup users can upload directly at Settings → Profile (2 MB cap, PNG/JPEG/WebP/GIF).

Shipped: Real brand icons. GitHub, Slack, and the Omium mark now use their real logos on the Integrations page, not geometric proxies.

Fixed: Billing pill said — / — runs for fresh and trialing tenants because the quota row wasn't materialized yet. Quota service now falls back to the plan's included allowance until real usage exists.

Renamed: included_credits → included_runs across the pricing, billing, and quota APIs. The dashboard, topbar meter, invoices, and every response payload now speak the same language. One run = one agent execution.

Plan allowances, restated in runs (dollars unchanged): Free 500 / mo, Developer 2,500 / mo, Pro 25,000 / mo, Enterprise custom.

Note: existing subscriptions were re-labelled in place. No re-signing, no plan changes required.

Shipped: GitOps promote-by-SHA. Every omium/*: built against staging replicates automatically to the prod ECR via cross-account replication. Promotion to prod is a values.prod.yaml SHA pin, committed to the gitops repo; ArgoCD auto-syncs. No rebuild for prod, no image drift between environments — the bytes that ran in staging are the bytes running in prod.

Shipped: Fail-closed prod bring-up. When ENVIRONMENT=production, auth, billing, and the recovery orchestrator run the strict path — real secrets or 503. There is no partially-configured prod.

Shipped: Stripe v15 across the board. Webhooks, subscription lifecycle, and top-up checkout are all on the current SDK. Signature verification is enforced on every inbound webhook.

Shipped: Nebius Token Factory backend. Cutover from GCP Vertex. OpenAI-compatible endpoint, API key + model IDs configured per environment. Zero application code changed.

Shipped: New default catalog. moonshotai/Kimi-K2.7-Code for generation, zai-org/GLM-5.2 as the tier-2 cross-family judge, Qwen/Qwen3-30B-A3B-Instruct-2507 for cheap classification.

Why cross-family? When the generator and evaluator share a model family, they share failure modes — the classic self-confirmation trap of correlated generator/evaluator. Omium's tier-2 judge is CI-pinned to a family *different* from the generator. Verification isn't a mirror of the thing being verified.

Under the hood: the router is provider-agnostic — any OpenAI-compatible backend can be swapped in with a single config flip. LLM backend choice is no longer a code change.

Shipped: Counterfactual-replay attribution. For every recovered failure, the tracer isolates the *decisive step* — the one whose alteration flips the outcome. We only stamp decisive_step_source = replay_derived when a bounded counterfactual replay confirmed the step was necessary. Nothing else counts as attribution.

Shipped: Zero-LLM reuse. Once a failure signature has a recorded decisive step, subsequent occurrences reuse it directly — no LLM diagnose round, no cost, no latency. New signatures still take the full attribution path. This is a real cost line item, not a micro-optimization: repeat failures were paying the diagnose bill every time.

Shipped: Recovery orchestrator hardening. Lease-fenced CAS state machine (DETECTED → DIAGNOSING → FIXING → RERUNNING → VERIFYING → VERIFIED) on a durable Redis stream with dedup + reaper. Failures survive process crashes; the sole owner of the failure record is enforced by lease.

Shipped: Node-span emitter for the execution engine (dormant behind NODE_SPANS_ENABLED, fail-soft). When flipped on, every workflow node emits a first-class span with omium.node_kind and omium.node_label attributes — the Workflow tab uses these when they're present.

Shipped: Pre-vote + leader metrics. Nodes now hold a pre-vote round before soliciting a full election, and leader-visibility metrics are exported per-round. Together they prevent split-brain during transient network partitions instead of surfacing it after the fact.

Shipped: Majority index cleanup. Removed a stale constant that occasionally miscounted quorum on even-sized clusters. Majority is now derived from the live cluster size on every commit round.

Shipped: Heartbeat cronjob + alert-rule tuning. Cluster health degrades to severe *before* quorum is lost, not after — you find out about the partition when you can still do something about it.

Why this matters: the consensus seam is groundwork for tier-3 verification. When the tier-1 deterministic probe is silent and the tier-2 cross-family judge is split, a BFT quorum of independent judges is what settles the vote. The seam is dormant behind a flag today; the plumbing is done.

Shipped: Per-plane quota metering. Each part of Omium meters on its own, with its own included allowance and its own overage rate:

• Verification — included runs, storage, traces, and API calls per month.
• Recovery — autonomy tier (L1–L4) and included recovery count.
• Compute — the tenant's compute tier and its included GPU minutes.
• Environments — included environment slots and sandbox hours.

Feature gates (RBAC, audit-log export, custom integrations) are enforced server-side per tier, not by client-side flags.

Shipped: Compute packs. One-time top-ups via Stripe checkout, credited to the tenant's balance immediately. Useful when a long job is close to done and the month's bundle is already spent.

Shipped: CrewAI adapter policy scoping. Policy evaluation on the CrewAI adapter now attaches to the execution_id, not the shared runtime agent id. Cross-execution contamination on shared crews is gone.

Fixed: an ENUM migration that failed on fresh databases when the enum type existed only in a non-default schema. All migrations now create ENUMs in public explicitly.