From 88d7da050d5fa4eec0e5be9a649d2253eab4de4c Mon Sep 17 00:00:00 2001
From: "openstack-experimental-release-plz[bot]"
 <246136148+openstack-experimental-release-plz[bot]@users.noreply.github.com>
Date: Tue, 13 Oct 2026 05:29:17 +0000
Subject: [PATCH] chore: release

---
 Cargo.lock                                    |   8 +-
 Cargo.toml                                    |   8 +-
 crates/api-key-driver-raft/CHANGELOG.md       |  22 ++
 crates/api-types/CHANGELOG.md                 | 115 ++++++++
 crates/api-types/Cargo.toml                   |   2 +-
 crates/appcred-driver-sql/CHANGELOG.md        |  34 +++
 crates/assignment-driver-openfga/CHANGELOG.md |  25 ++
 crates/assignment-driver-sql/CHANGELOG.md     |  39 +++
 crates/auth-plugin-core/CHANGELOG.md          |  14 +
 .../CHANGELOG.md                              |  16 +
 crates/auth-plugin-runtime/CHANGELOG.md       |  22 ++
 crates/cadf/CHANGELOG.md                      |  30 ++
 crates/catalog-driver-sql/CHANGELOG.md        |  35 +++
 crates/cli-manage/CHANGELOG.md                |  58 ++++
 crates/config/CHANGELOG.md                    | 131 +++++++++
 crates/core-types/CHANGELOG.md                | 139 +++++++++
 crates/core/CHANGELOG.md                      | 217 ++++++++++++++
 crates/core/Cargo.toml                        |   2 +-
 crates/credential-driver-sql/CHANGELOG.md     |  32 ++
 crates/domain-config-driver-fs/CHANGELOG.md   |  23 ++
 crates/domain-config-driver-sql/CHANGELOG.md  |  26 ++
 crates/federation-driver-sql/CHANGELOG.md     |  27 ++
 crates/identity-driver-ldap/CHANGELOG.md      |  24 ++
 crates/identity-driver-sql/CHANGELOG.md       |  54 ++++
 crates/idmapping-driver-sql/CHANGELOG.md      |  28 ++
 crates/k8s-auth-driver-raft/CHANGELOG.md      |  26 ++
 crates/k8s-auth-driver-sql/CHANGELOG.md       |  26 ++
 crates/key-repository/CHANGELOG.md            |  31 ++
 crates/keystone/CHANGELOG.md                  | 273 ++++++++++++++++++
 crates/keystone/Cargo.toml                    |   2 +-
 crates/limit-driver-sql/CHANGELOG.md          |  15 +
 crates/local-emergency-store/CHANGELOG.md     |  19 ++
 crates/mapping-driver-raft/CHANGELOG.md       |  23 ++
 crates/oauth2-client-driver-raft/CHANGELOG.md |  21 ++
 crates/oauth2-key-driver-raft/CHANGELOG.md    |  30 ++
 .../oauth2-session-driver-raft/CHANGELOG.md   |  39 +++
 crates/oslo-config/CHANGELOG.md               |  15 +
 crates/password-hashing/CHANGELOG.md          |  15 +
 crates/policy-store-driver-sql/CHANGELOG.md   |  16 +
 crates/resource-driver-sql/CHANGELOG.md       |  35 +++
 crates/revoke-driver-sql/CHANGELOG.md         |  28 ++
 crates/role-driver-sql/CHANGELOG.md           |  28 ++
 crates/scim-driver-raft/CHANGELOG.md          |  20 ++
 crates/storage-api/CHANGELOG.md               |  32 ++
 crates/storage-crypto-pkcs11/CHANGELOG.md     |  20 ++
 crates/storage-crypto-tpm/CHANGELOG.md        |  20 ++
 crates/storage-crypto/CHANGELOG.md            |  35 +++
 crates/storage/CHANGELOG.md                   | 105 +++++++
 crates/storage/Cargo.toml                     |   2 +-
 crates/telemetry/CHANGELOG.md                 |  14 +
 crates/token-driver-fernet/CHANGELOG.md       |  32 ++
 crates/token-driver-jws/CHANGELOG.md          |  28 ++
 .../token-restriction-driver-sql/CHANGELOG.md |  24 ++
 crates/trust-driver-sql/CHANGELOG.md          |  28 ++
 crates/webauthn/CHANGELOG.md                  |  60 ++++
 55 files changed, 2181 insertions(+), 12 deletions(-)
 create mode 100644 crates/api-key-driver-raft/CHANGELOG.md
 create mode 100644 crates/api-types/CHANGELOG.md
 create mode 100644 crates/appcred-driver-sql/CHANGELOG.md
 create mode 100644 crates/assignment-driver-openfga/CHANGELOG.md
 create mode 100644 crates/assignment-driver-sql/CHANGELOG.md
 create mode 100644 crates/auth-plugin-core/CHANGELOG.md
 create mode 100644 crates/auth-plugin-identity-driver-raft/CHANGELOG.md
 create mode 100644 crates/auth-plugin-runtime/CHANGELOG.md
 create mode 100644 crates/cadf/CHANGELOG.md
 create mode 100644 crates/catalog-driver-sql/CHANGELOG.md
 create mode 100644 crates/cli-manage/CHANGELOG.md
 create mode 100644 crates/config/CHANGELOG.md
 create mode 100644 crates/core-types/CHANGELOG.md
 create mode 100644 crates/core/CHANGELOG.md
 create mode 100644 crates/credential-driver-sql/CHANGELOG.md
 create mode 100644 crates/domain-config-driver-fs/CHANGELOG.md
 create mode 100644 crates/domain-config-driver-sql/CHANGELOG.md
 create mode 100644 crates/federation-driver-sql/CHANGELOG.md
 create mode 100644 crates/identity-driver-ldap/CHANGELOG.md
 create mode 100644 crates/identity-driver-sql/CHANGELOG.md
 create mode 100644 crates/idmapping-driver-sql/CHANGELOG.md
 create mode 100644 crates/k8s-auth-driver-raft/CHANGELOG.md
 create mode 100644 crates/k8s-auth-driver-sql/CHANGELOG.md
 create mode 100644 crates/key-repository/CHANGELOG.md
 create mode 100644 crates/keystone/CHANGELOG.md
 create mode 100644 crates/limit-driver-sql/CHANGELOG.md
 create mode 100644 crates/local-emergency-store/CHANGELOG.md
 create mode 100644 crates/mapping-driver-raft/CHANGELOG.md
 create mode 100644 crates/oauth2-client-driver-raft/CHANGELOG.md
 create mode 100644 crates/oauth2-key-driver-raft/CHANGELOG.md
 create mode 100644 crates/oauth2-session-driver-raft/CHANGELOG.md
 create mode 100644 crates/oslo-config/CHANGELOG.md
 create mode 100644 crates/password-hashing/CHANGELOG.md
 create mode 100644 crates/policy-store-driver-sql/CHANGELOG.md
 create mode 100644 crates/resource-driver-sql/CHANGELOG.md
 create mode 100644 crates/revoke-driver-sql/CHANGELOG.md
 create mode 100644 crates/role-driver-sql/CHANGELOG.md
 create mode 100644 crates/scim-driver-raft/CHANGELOG.md
 create mode 100644 crates/storage-api/CHANGELOG.md
 create mode 100644 crates/storage-crypto-pkcs11/CHANGELOG.md
 create mode 100644 crates/storage-crypto-tpm/CHANGELOG.md
 create mode 100644 crates/storage-crypto/CHANGELOG.md
 create mode 100644 crates/storage/CHANGELOG.md
 create mode 100644 crates/telemetry/CHANGELOG.md
 create mode 100644 crates/token-driver-fernet/CHANGELOG.md
 create mode 100644 crates/token-driver-jws/CHANGELOG.md
 create mode 100644 crates/token-restriction-driver-sql/CHANGELOG.md
 create mode 100644 crates/trust-driver-sql/CHANGELOG.md
 create mode 100644 crates/webauthn/CHANGELOG.md

diff --git a/Cargo.lock b/Cargo.lock
index 8d40244f5..d4ddfa1e2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4999,7 +4999,7 @@ dependencies = [
 
 [[package]]
 name = "openstack-keystone"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
  "async-trait",
  "axum",
@@ -5121,7 +5121,7 @@ dependencies = [
 
 [[package]]
 name = "openstack-keystone-api-types"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "axum",
  "base64 0.23.1",
@@ -5326,7 +5326,7 @@ dependencies = [
 
 [[package]]
 name = "openstack-keystone-core"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
  "arc-swap",
  "argon2",
@@ -5430,7 +5430,7 @@ dependencies = [
 
 [[package]]
 name = "openstack-keystone-distributed-storage"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "async-trait",
  "byteorder",
diff --git a/Cargo.toml b/Cargo.toml
index 8d51a0108..ad0690edb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -137,10 +137,10 @@ openstack-keystone-assignment-driver-sql = { version = "0.1", path = "crates/ass
 openstack-keystone-catalog-driver-sql = { version = "0.1", path = "crates/catalog-driver-sql/" }
 openstack-keystone-config = { version = "0.1.0", path = "crates/config"}
 oslo-config = { version = "0.1.0", path = "crates/oslo-config" }
-openstack-keystone-core = { version = "0.1.0", path = "crates/core" }
-openstack-keystone-core-types = { version = "0.1.0", path = "crates/core-types" }
+openstack-keystone-core = { version = "0.1.2", path = "crates/core" }
+openstack-keystone-core-types = { version = "0.1.1", path = "crates/core-types" }
 openstack-keystone-credential-driver-sql = { version = "0.1", path = "crates/credential-driver-sql/" }
-openstack-keystone-distributed-storage = { version = "0.1.0", path = "crates/storage"}
+openstack-keystone-distributed-storage = { version = "0.1.1", path = "crates/storage"}
 openstack-keystone-domain-config-driver-fs = { version = "0.1", path = "crates/domain-config-driver-fs/" }
 openstack-keystone-domain-config-driver-sql = { version = "0.1", path = "crates/domain-config-driver-sql/" }
 openstack-keystone-auth-plugin-core = { version = "0.1.0", path = "crates/auth-plugin-core" }
@@ -173,7 +173,7 @@ openstack-keystone-resource-driver-sql = { version = "0.1", path = "crates/resou
 openstack-keystone-revoke-driver-sql = { version = "0.1", path = "crates/revoke-driver-sql/" }
 openstack-keystone-role-driver-sql = { version = "0.1", path = "crates/role-driver-sql/" }
 openstack-keystone-scim-driver-raft = { version = "0.1", path = "crates/scim-driver-raft/" }
-openstack-keystone-token-driver-fernet = { version = "0.1.0", path = "crates/token-driver-fernet" }
+openstack-keystone-token-driver-fernet = { version = "0.1.1", path = "crates/token-driver-fernet" }
 openstack-keystone-token-driver-jws = { version = "0.1.0", path = "crates/token-driver-jws" }
 openstack-keystone-token-restriction-driver-sql = { version = "0.1", path = "crates/token-restriction-driver-sql/" }
 openstack-keystone-trust-driver-sql = { version = "0.1", path = "crates/trust-driver-sql/" }
diff --git a/crates/api-key-driver-raft/CHANGELOG.md b/crates/api-key-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..5fc735a32
--- /dev/null
+++ b/crates/api-key-driver-raft/CHANGELOG.md
@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-api-key-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
diff --git a/crates/api-types/CHANGELOG.md b/crates/api-types/CHANGELOG.md
new file mode 100644
index 000000000..7f716fe66
--- /dev/null
+++ b/crates/api-types/CHANGELOG.md
@@ -0,0 +1,115 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.1](https://github.com/openstack-experimental/keystone/compare/openstack-keystone-api-types-v0.1.0...openstack-keystone-api-types-v0.1.1) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Use control-plane aud for tokens ([#1498](https://github.com/openstack-experimental/keystone/pull/1498))
+- *(oauth2)* Add back-channel logout ([#1493](https://github.com/openstack-experimental/keystone/pull/1493))
+- *(oauth2)* Remember consent per client ([#1476](https://github.com/openstack-experimental/keystone/pull/1476))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add client display metadata ([#1472](https://github.com/openstack-experimental/keystone/pull/1472))
+- *(resource)* Add enabled filter to project list ([#1453](https://github.com/openstack-experimental/keystone/pull/1453))
+- *(identity)* Add enabled filter to user list ([#1451](https://github.com/openstack-experimental/keystone/pull/1451))
+- Implement authc by app credential ([#1187](https://github.com/openstack-experimental/keystone/pull/1187))
+- *(limit)* Add unified limits ([#1407](https://github.com/openstack-experimental/keystone/pull/1407))
+- *(devstack)* Pilot ksm SPIFFE mTLS transport ([#1239](https://github.com/openstack-experimental/keystone/pull/1239))
+- *(assignment)* Add OpenFGA assignment driver ([#1206](https://github.com/openstack-experimental/keystone/pull/1206))
+- *(domain-config)* Dispatch identity ops per domain ([#1202](https://github.com/openstack-experimental/keystone/pull/1202))
+- *(domain-config)* Add configuration API ([#1201](https://github.com/openstack-experimental/keystone/pull/1201))
+- Add vendor data JWT API for SPIRE integration ([#1192](https://github.com/openstack-experimental/keystone/pull/1192))
+- *(api)* Log response body for all 4xx/5xx errors ([#1171](https://github.com/openstack-experimental/keystone/pull/1171))
+- *(api)* Log error details in IntoResponse ([#1169](https://github.com/openstack-experimental/keystone/pull/1169))
+- *(policy)* Implement legacy Policy API (/v3/policies) ([#1127](https://github.com/openstack-experimental/keystone/pull/1127))
+- Filter user listing by type ([#813](https://github.com/openstack-experimental/keystone/pull/813))
+- *(loadtest)* Add more auth tests ([#1119](https://github.com/openstack-experimental/keystone/pull/1119))
+- *(pagination)* Add pagination to remaining places ([#1106](https://github.com/openstack-experimental/keystone/pull/1106))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(identity)* Add trust create/delete and REST CRUD ([#1079](https://github.com/openstack-experimental/keystone/pull/1079))
+- *(catalog)* Expose /v3/regions REST API ([#1078](https://github.com/openstack-experimental/keystone/pull/1078))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- *(ldap)* Add LDAP identity driver ([#1047](https://github.com/openstack-experimental/keystone/pull/1047))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- Add catalog CRUD API and bootstrap support ([#1029](https://github.com/openstack-experimental/keystone/pull/1029))
+- *(adr0026)* Extend keystone-manage oauth2 CLI ([#1020](https://github.com/openstack-experimental/keystone/pull/1020))
+- *(adr0026)* Phase 6a ([#1017](https://github.com/openstack-experimental/keystone/pull/1017))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 2 client registration & OIDC discovery ([#1013](https://github.com/openstack-experimental/keystone/pull/1013))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(identity)* Add per-user auth rate limiting ([#996](https://github.com/openstack-experimental/keystone/pull/996))
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
+- *(identity)* Implement user password change endpoint ([#970](https://github.com/openstack-experimental/keystone/pull/970))
+- *(api)* Add global IP rate limiting framework (ADR-0022 phase 1) ([#846](https://github.com/openstack-experimental/keystone/pull/846))
+- *(adr0025)* Phase 1 (1.1+1.2) ([#952](https://github.com/openstack-experimental/keystone/pull/952))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- Migrate federation to new mapping engine ([#839](https://github.com/openstack-experimental/keystone/pull/839))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- *(mapping)* ADR-0020 phase 2 ([#807](https://github.com/openstack-experimental/keystone/pull/807))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Validate password for compliance conformity ([#774](https://github.com/openstack-experimental/keystone/pull/774))
+- Add system-user-role assignments API ([#762](https://github.com/openstack-experimental/keystone/pull/762))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Add api to list user roles on project ([#639](https://github.com/openstack-experimental/keystone/pull/639))
+- Add domain CRUD operations ([#743](https://github.com/openstack-experimental/keystone/pull/743))
+- Add spiffe binding API ([#740](https://github.com/openstack-experimental/keystone/pull/740))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+
+### Fixed
+
+- *(resource)* Reject project names over 64 chars ([#1455](https://github.com/openstack-experimental/keystone/pull/1455))
+- *(resource)* Align domain and project response shape ([#1454](https://github.com/openstack-experimental/keystone/pull/1454))
+- *(application_credential)* Accept tempest create payloads ([#1446](https://github.com/openstack-experimental/keystone/pull/1446))
+- Next round of security review fixes ([#1241](https://github.com/openstack-experimental/keystone/pull/1241))
+- *(api-types)* Allow empty domain description ([#1237](https://github.com/openstack-experimental/keystone/pull/1237))
+- *(types)* Remove invalid PartialEq from AppCred wrappers ([#1191](https://github.com/openstack-experimental/keystone/pull/1191))
+- *(logging)* Surface 5xx causes at error level ([#1172](https://github.com/openstack-experimental/keystone/pull/1172))
+- Register UserType in OpenAPI components schema ([#1151](https://github.com/openstack-experimental/keystone/pull/1151))
+- Map raft-not-available to proper HTTP status codes ([#1149](https://github.com/openstack-experimental/keystone/pull/1149))
+- *(api)* Fix pagination limit, filters, and rows ([#1115](https://github.com/openstack-experimental/keystone/pull/1115))
+- Address multiple tempest failures ([#1083](https://github.com/openstack-experimental/keystone/pull/1083))
+- *(api)* Default enabled/domain_id on create ([#1073](https://github.com/openstack-experimental/keystone/pull/1073))
+- *(security)* Address security review findings ([#1049](https://github.com/openstack-experimental/keystone/pull/1049))
+- *(federation)* Allow long external unique_id values ([#1033](https://github.com/openstack-experimental/keystone/pull/1033))
+- Unify ApiClient scope validation, fix nextest filter ([#947](https://github.com/openstack-experimental/keystone/pull/947))
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+
+### Other
+
+- Feature/system assignment group ([#796](https://github.com/openstack-experimental/keystone/pull/796))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(api)* Harden v3 authorization and authentication coverage ([#1166](https://github.com/openstack-experimental/keystone/pull/1166))
+- *(identity)* Remove service account API methods ([#1152](https://github.com/openstack-experimental/keystone/pull/1152))
+- Feature/expose app credential ([#948](https://github.com/openstack-experimental/keystone/pull/948))
+- *(api)* Expand v3 coverage and enforce EC2 token restrictions ([#1084](https://github.com/openstack-experimental/keystone/pull/1084))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(test)* Improve testing of the oauth2 OP ([#1024](https://github.com/openstack-experimental/keystone/pull/1024))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- *(tests)* Reorganize integration_api tests ([#815](https://github.com/openstack-experimental/keystone/pull/815))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- Small optimization of the derives ([#638](https://github.com/openstack-experimental/keystone/pull/638))
+- Split the core-types crate ([#640](https://github.com/openstack-experimental/keystone/pull/640))
+- Introduce features in api-types crate ([#624](https://github.com/openstack-experimental/keystone/pull/624))
+- Slim down api-types crate ([#622](https://github.com/openstack-experimental/keystone/pull/622))
diff --git a/crates/api-types/Cargo.toml b/crates/api-types/Cargo.toml
index 79a84f3a3..56b8c3f4e 100644
--- a/crates/api-types/Cargo.toml
+++ b/crates/api-types/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "openstack-keystone-api-types"
 description = "OpenStack Keystone API types"
-version = "0.1.0"
+version = "0.1.1"
 rust-version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/appcred-driver-sql/CHANGELOG.md b/crates/appcred-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..054b66247
--- /dev/null
+++ b/crates/appcred-driver-sql/CHANGELOG.md
@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-appcred-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Implement authc by app credential ([#1187](https://github.com/openstack-experimental/keystone/pull/1187))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- Add access rule CRD to appcred provider ([#806](https://github.com/openstack-experimental/keystone/pull/806))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- Ensure appcred are unique over name+user_id ([#1150](https://github.com/openstack-experimental/keystone/pull/1150))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Feature/expose app credential ([#948](https://github.com/openstack-experimental/keystone/pull/948))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Extract password hashing into own crate ([#1055](https://github.com/openstack-experimental/keystone/pull/1055))
+- *(core)* Eliminate XxxProvider enums ([#830](https://github.com/openstack-experimental/keystone/pull/830))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
diff --git a/crates/assignment-driver-openfga/CHANGELOG.md b/crates/assignment-driver-openfga/CHANGELOG.md
new file mode 100644
index 000000000..7145294ab
--- /dev/null
+++ b/crates/assignment-driver-openfga/CHANGELOG.md
@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-assignment-driver-openfga-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(adr0034)* Build per-instance assignment backends ([#1218](https://github.com/openstack-experimental/keystone/pull/1218))
+- *(assignment)* Add OpenFGA assignment driver ([#1206](https://github.com/openstack-experimental/keystone/pull/1206))
+
+### Fixed
+
+- *(adr0034)* Post implementation fixes ([#1223](https://github.com/openstack-experimental/keystone/pull/1223))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
diff --git a/crates/assignment-driver-sql/CHANGELOG.md b/crates/assignment-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..de6cecdbb
--- /dev/null
+++ b/crates/assignment-driver-sql/CHANGELOG.md
@@ -0,0 +1,39 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-assignment-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(adr0034)* Route assignment ops per domain ([#1219](https://github.com/openstack-experimental/keystone/pull/1219))
+- *(adr0034)* Build per-instance assignment backends ([#1218](https://github.com/openstack-experimental/keystone/pull/1218))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(pagination)* Add pagination to remaining places ([#1106](https://github.com/openstack-experimental/keystone/pull/1106))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- Respect group_id param in assignment list ([#953](https://github.com/openstack-experimental/keystone/pull/953))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+
+### Other
+
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(db)* 3 optimizations for DB queries ([#1111](https://github.com/openstack-experimental/keystone/pull/1111))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
diff --git a/crates/auth-plugin-core/CHANGELOG.md b/crates/auth-plugin-core/CHANGELOG.md
new file mode 100644
index 000000000..6b1451776
--- /dev/null
+++ b/crates/auth-plugin-core/CHANGELOG.md
@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-auth-plugin-core-v0.1.0) - 2026-10-13
+
+### Other
+
+- Split extism out of core's dependency tree ([#1148](https://github.com/openstack-experimental/keystone/pull/1148))
diff --git a/crates/auth-plugin-identity-driver-raft/CHANGELOG.md b/crates/auth-plugin-identity-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..b7cf5f793
--- /dev/null
+++ b/crates/auth-plugin-identity-driver-raft/CHANGELOG.md
@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-auth-plugin-identity-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
diff --git a/crates/auth-plugin-runtime/CHANGELOG.md b/crates/auth-plugin-runtime/CHANGELOG.md
new file mode 100644
index 000000000..7288135f6
--- /dev/null
+++ b/crates/auth-plugin-runtime/CHANGELOG.md
@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-auth-plugin-runtime-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
+
+### Fixed
+
+- Match real app-cred id field in route plugin ([#1242](https://github.com/openstack-experimental/keystone/pull/1242))
+
+### Other
+
+- Split extism out of core's dependency tree ([#1148](https://github.com/openstack-experimental/keystone/pull/1148))
diff --git a/crates/cadf/CHANGELOG.md b/crates/cadf/CHANGELOG.md
new file mode 100644
index 000000000..075138c17
--- /dev/null
+++ b/crates/cadf/CHANGELOG.md
@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/cadf-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(cadf)* Use DSP0262 names on the wire ([#1419](https://github.com/openstack-experimental/keystone/pull/1419))
+- *(audit)* Add opt-in per-request perimeter record ([#1415](https://github.com/openstack-experimental/keystone/pull/1415))
+
+### Fixed
+
+- *(oauth2)* Check client on device grant redeem ([#1435](https://github.com/openstack-experimental/keystone/pull/1435))
+- *(audit)* Polish the CADF crate ([#1424](https://github.com/openstack-experimental/keystone/pull/1424))
+
+### Other
+
+- *(audit)* Assert live audit spool records ([#1422](https://github.com/openstack-experimental/keystone/pull/1422))
+- *(audit)* Cover startup seal, quarantine, hooks ([#1410](https://github.com/openstack-experimental/keystone/pull/1410))
+- *(cadf)* Move audit startup into runtime ([#1406](https://github.com/openstack-experimental/keystone/pull/1406))
+- *(cadf)* Own the audit configuration ([#1405](https://github.com/openstack-experimental/keystone/pull/1405))
+- *(cadf)* Parameterize the service identity ([#1400](https://github.com/openstack-experimental/keystone/pull/1400))
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
diff --git a/crates/catalog-driver-sql/CHANGELOG.md b/crates/catalog-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..a90c9cfbe
--- /dev/null
+++ b/crates/catalog-driver-sql/CHANGELOG.md
@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-catalog-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Add OS-EP-FILTER provider CRUD to the catalog ([#1075](https://github.com/openstack-experimental/keystone/pull/1075))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add endpoint CRUD to catalog provider ([#785](https://github.com/openstack-experimental/keystone/pull/785))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add service CRUD to the catalog provider ([#773](https://github.com/openstack-experimental/keystone/pull/773))
+- Add region CRUD to catalog SQL driver ([#761](https://github.com/openstack-experimental/keystone/pull/761))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- Align "extra" property handling ([#787](https://github.com/openstack-experimental/keystone/pull/787))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
diff --git a/crates/cli-manage/CHANGELOG.md b/crates/cli-manage/CHANGELOG.md
new file mode 100644
index 000000000..2c98ef897
--- /dev/null
+++ b/crates/cli-manage/CHANGELOG.md
@@ -0,0 +1,58 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-cli-manage-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(storage)* Transfer leadership on demote ([#1462](https://github.com/openstack-experimental/keystone/pull/1462))
+- *(storage)* Show DEK state in list-peers ([#1460](https://github.com/openstack-experimental/keystone/pull/1460))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(audit)* Add HMAC key rotation and node checks ([#1382](https://github.com/openstack-experimental/keystone/pull/1382))
+- *(raft)* Add backup restore ([#1352](https://github.com/openstack-experimental/keystone/pull/1352))
+- *(cli-manage)* Add mapping ruleset commands ([#1244](https://github.com/openstack-experimental/keystone/pull/1244))
+- *(devstack)* Pilot ksm SPIFFE mTLS transport ([#1239](https://github.com/openstack-experimental/keystone/pull/1239))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- *(config)* Add Vault-backed configuration ([#1051](https://github.com/openstack-experimental/keystone/pull/1051))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- *(cli-manage)* Make catalog create idempotent ([#1031](https://github.com/openstack-experimental/keystone/pull/1031))
+- Add catalog CRUD API and bootstrap support ([#1029](https://github.com/openstack-experimental/keystone/pull/1029))
+- *(adr0026)* Extend keystone-manage oauth2 CLI ([#1020](https://github.com/openstack-experimental/keystone/pull/1020))
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Add SPIFFE mTLS support to Raft gRPC ([#852](https://github.com/openstack-experimental/keystone/pull/852))
+- *(cli)* Add cli storage subcommands per ADR 0016-v2 ([#850](https://github.com/openstack-experimental/keystone/pull/850))
+- *(storage)* implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine ([#840](https://github.com/openstack-experimental/keystone/pull/840))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(storage)* Adopt cluster DEK in storage join ([#1463](https://github.com/openstack-experimental/keystone/pull/1463))
+- *(resource)* Align domain and project response shape ([#1454](https://github.com/openstack-experimental/keystone/pull/1454))
+- *(storage)* Route admin RPCs to the Raft leader ([#1447](https://github.com/openstack-experimental/keystone/pull/1447))
+- *(cli-manage)* Pin admin client SVID to admin_svid ([#1428](https://github.com/openstack-experimental/keystone/pull/1428))
+- *(storage)* Authorize Raft and Storage gRPC callers ([#1418](https://github.com/openstack-experimental/keystone/pull/1418))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+
+### Other
+
+- *(cadf)* Own the audit configuration ([#1405](https://github.com/openstack-experimental/keystone/pull/1405))
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Upgrade comfy-table to v8 ([#1164](https://github.com/openstack-experimental/keystone/pull/1164))
+- *(test)* Improve testing of the oauth2 OP ([#1024](https://github.com/openstack-experimental/keystone/pull/1024))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Unify sea-orm features ([#769](https://github.com/openstack-experimental/keystone/pull/769))
diff --git a/crates/config/CHANGELOG.md b/crates/config/CHANGELOG.md
new file mode 100644
index 000000000..0805c1ecd
--- /dev/null
+++ b/crates/config/CHANGELOG.md
@@ -0,0 +1,131 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-config-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Harden SSO sessions ([#1490](https://github.com/openstack-experimental/keystone/pull/1490))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add TOTP second factor to OP login ([#1473](https://github.com/openstack-experimental/keystone/pull/1473))
+- *(oauth2)* Add client display metadata ([#1472](https://github.com/openstack-experimental/keystone/pull/1472))
+- *(oauth2)* Brand and localize the login pages ([#1471](https://github.com/openstack-experimental/keystone/pull/1471))
+- *(oauth2)* Add operator login page templates ([#1470](https://github.com/openstack-experimental/keystone/pull/1470))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(limit)* Add unified limits ([#1407](https://github.com/openstack-experimental/keystone/pull/1407))
+- *(audit)* Add HMAC key rotation and node checks ([#1382](https://github.com/openstack-experimental/keystone/pull/1382))
+- *(audit)* Add an RFC 5424 syslog sink ([#1381](https://github.com/openstack-experimental/keystone/pull/1381))
+- *(audit)* Make channel and spool limits configurable ([#1380](https://github.com/openstack-experimental/keystone/pull/1380))
+- *(audit)* Add an enabled switch ([#1379](https://github.com/openstack-experimental/keystone/pull/1379))
+- *(audit)* Ship sealed spool segments to a sink ([#1374](https://github.com/openstack-experimental/keystone/pull/1374))
+- *(oauth2)* Cap refresh families and revalidate user ([#1360](https://github.com/openstack-experimental/keystone/pull/1360))
+- *(oauth2-session)* Add expired record janitor ([#1359](https://github.com/openstack-experimental/keystone/pull/1359))
+- *(raft)* Add backup restore ([#1352](https://github.com/openstack-experimental/keystone/pull/1352))
+- *(devstack)* Pilot ksm SPIFFE mTLS transport ([#1239](https://github.com/openstack-experimental/keystone/pull/1239))
+- Hot-reload fs per-domain config files ([#1225](https://github.com/openstack-experimental/keystone/pull/1225))
+- *(adr0034)* Route assignment ops per domain ([#1219](https://github.com/openstack-experimental/keystone/pull/1219))
+- *(adr0034)* Add per-domain driver config surface ([#1216](https://github.com/openstack-experimental/keystone/pull/1216))
+- *(assignment)* Add OpenFGA assignment driver ([#1206](https://github.com/openstack-experimental/keystone/pull/1206))
+- *(domain-config)* Add resolution layer ([#1199](https://github.com/openstack-experimental/keystone/pull/1199))
+- *(domain-config)* Add filesystem driver ([#1197](https://github.com/openstack-experimental/keystone/pull/1197))
+- *(spiffe)* Derive spiffe claims ([#1193](https://github.com/openstack-experimental/keystone/pull/1193))
+- Add vendor data JWT API for SPIRE integration ([#1192](https://github.com/openstack-experimental/keystone/pull/1192))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(policy)* Implement legacy Policy API (/v3/policies) ([#1127](https://github.com/openstack-experimental/keystone/pull/1127))
+- Add domain config types and backend trait ([#1138](https://github.com/openstack-experimental/keystone/pull/1138))
+- *(adr0031)* Add HTTP request metrics ([#1134](https://github.com/openstack-experimental/keystone/pull/1134))
+- *(config)* Support configurable log file rotation ([#1128](https://github.com/openstack-experimental/keystone/pull/1128))
+- Add connection_debug to tune SQL query logging ([#1109](https://github.com/openstack-experimental/keystone/pull/1109))
+- *(pagination)* Add pagination to remaining places ([#1106](https://github.com/openstack-experimental/keystone/pull/1106))
+- *(config)* Revoke Vault token on shutdown ([#1088](https://github.com/openstack-experimental/keystone/pull/1088))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(config)* Add Vault-backed configuration ([#1051](https://github.com/openstack-experimental/keystone/pull/1051))
+- *(logging)* Add native journald log writer ([#1081](https://github.com/openstack-experimental/keystone/pull/1081))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- *(ldap)* Add LDAP identity driver ([#1047](https://github.com/openstack-experimental/keystone/pull/1047))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- Add catalog CRUD API and bootstrap support ([#1029](https://github.com/openstack-experimental/keystone/pull/1029))
+- *(adr0026)* Add RFC 8628 Device Authorization Grant ([#1023](https://github.com/openstack-experimental/keystone/pull/1023))
+- *(adr0026)* Add authorization code flow with PKCE ([#1015](https://github.com/openstack-experimental/keystone/pull/1015))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 2 client registration & OIDC discovery ([#1013](https://github.com/openstack-experimental/keystone/pull/1013))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(api)* capture client IP via proxy headers & SPIFFE (#358 follow-up) ([#908](https://github.com/openstack-experimental/keystone/pull/908))
+- *(identity)* Add per-user auth rate limiting ([#996](https://github.com/openstack-experimental/keystone/pull/996))
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
+- *(api)* Add global IP rate limiting framework (ADR-0022 phase 1) ([#846](https://github.com/openstack-experimental/keystone/pull/846))
+- *(scim)* Harden RFC 7644 compliance, add docs ([#968](https://github.com/openstack-experimental/keystone/pull/968))
+- *(adr0025)* Phase 1 (1.1+1.2) ([#952](https://github.com/openstack-experimental/keystone/pull/952))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- Start ADR 0025 immplementation ([#911](https://github.com/openstack-experimental/keystone/pull/911))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- Prepare PKCS#11/TPM KEK support in storage ([#907](https://github.com/openstack-experimental/keystone/pull/907))
+- *(credential)* Implement ADR 0019 phases 1-2 ([#897](https://github.com/openstack-experimental/keystone/pull/897))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- *(auth)* Password hashing parity with Python Keystone ([#859](https://github.com/openstack-experimental/keystone/pull/859))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Harden preflight and erase dev KEK ([#860](https://github.com/openstack-experimental/keystone/pull/860))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add SO_PEERCRED peer credential validation ([#775](https://github.com/openstack-experimental/keystone/pull/775))
+- Validate password for compliance conformity ([#774](https://github.com/openstack-experimental/keystone/pull/774))
+- Enforce minimum range boundaries for security
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Add keystone container with opa and policies ([#738](https://github.com/openstack-experimental/keystone/pull/738))
+- Add Admin interface over the UDS ([#735](https://github.com/openstack-experimental/keystone/pull/735))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce raft backend for webauthn ([#658](https://github.com/openstack-experimental/keystone/pull/658))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(auth-plugins)* Raise default invocation rate limits ([#1437](https://github.com/openstack-experimental/keystone/pull/1437))
+- *(oauth2)* Pin issuer to public_endpoint ([#1436](https://github.com/openstack-experimental/keystone/pull/1436))
+- *(oauth2)* Rate limit device_code token grant ([#1434](https://github.com/openstack-experimental/keystone/pull/1434))
+- *(storage)* Authorize Raft and Storage gRPC callers ([#1418](https://github.com/openstack-experimental/keystone/pull/1418))
+- *(raft)* Rotate audit key per DEK epoch ([#1362](https://github.com/openstack-experimental/keystone/pull/1362))
+- *(audit)* Stop spool replay from looping into itself ([#1350](https://github.com/openstack-experimental/keystone/pull/1350))
+- *(raft)* Fail closed on stale ReadIndex reads ([#1341](https://github.com/openstack-experimental/keystone/pull/1341))
+- Next round of security review fixes ([#1241](https://github.com/openstack-experimental/keystone/pull/1241))
+- *(adr0034)* Post implementation fixes ([#1223](https://github.com/openstack-experimental/keystone/pull/1223))
+- Avoid blocking notify's event thread in watch_loop ([#1125](https://github.com/openstack-experimental/keystone/pull/1125))
+- Fix flaky test ([#1110](https://github.com/openstack-experimental/keystone/pull/1110))
+- *(security)* Address security review findings ([#1049](https://github.com/openstack-experimental/keystone/pull/1049))
+- *(passkey)* Prevent user enumeration ([#905](https://github.com/openstack-experimental/keystone/pull/905))
+
+### Other
+
+- *(config)* Pin reload and overlay behaviour ([#1421](https://github.com/openstack-experimental/keystone/pull/1421))
+- *(cadf)* Own the audit configuration ([#1405](https://github.com/openstack-experimental/keystone/pull/1405))
+- *(audit)* Cover spool, rotation and hook paths ([#1391](https://github.com/openstack-experimental/keystone/pull/1391))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(config)* Fix flaky notify watcher tests ([#1112](https://github.com/openstack-experimental/keystone/pull/1112))
+- Revise documentation layout ([#1069](https://github.com/openstack-experimental/keystone/pull/1069))
+- Moves health and metrics endpoints to dedicated listener on separate port ([#910](https://github.com/openstack-experimental/keystone/pull/910))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Replace Regex with str::find for db connection ([#760](https://github.com/openstack-experimental/keystone/pull/760))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- Split out remaining sql drivers ([#633](https://github.com/openstack-experimental/keystone/pull/633))
+- Split config into standalone crate ([#628](https://github.com/openstack-experimental/keystone/pull/628))
diff --git a/crates/core-types/CHANGELOG.md b/crates/core-types/CHANGELOG.md
new file mode 100644
index 000000000..cdace6f60
--- /dev/null
+++ b/crates/core-types/CHANGELOG.md
@@ -0,0 +1,139 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.1](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-core-types-v0.1.1) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Use control-plane aud for tokens ([#1498](https://github.com/openstack-experimental/keystone/pull/1498))
+- *(oauth2)* Add back-channel logout ([#1493](https://github.com/openstack-experimental/keystone/pull/1493))
+- *(oauth2)* Add federated sign-in to device page ([#1491](https://github.com/openstack-experimental/keystone/pull/1491))
+- *(oauth2)* Harden SSO sessions ([#1490](https://github.com/openstack-experimental/keystone/pull/1490))
+- *(oauth2)* Remember consent per client ([#1476](https://github.com/openstack-experimental/keystone/pull/1476))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add federated sign-in to OP login ([#1474](https://github.com/openstack-experimental/keystone/pull/1474))
+- *(oauth2)* Add TOTP second factor to OP login ([#1473](https://github.com/openstack-experimental/keystone/pull/1473))
+- *(oauth2)* Add client display metadata ([#1472](https://github.com/openstack-experimental/keystone/pull/1472))
+- *(resource)* Add enabled filter to project list ([#1453](https://github.com/openstack-experimental/keystone/pull/1453))
+- *(identity)* Add enabled filter to user list ([#1451](https://github.com/openstack-experimental/keystone/pull/1451))
+- *(oauth2)* Rotate signing keys automatically ([#1440](https://github.com/openstack-experimental/keystone/pull/1440))
+- Implement authc by app credential ([#1187](https://github.com/openstack-experimental/keystone/pull/1187))
+- *(limit)* Add unified limits ([#1407](https://github.com/openstack-experimental/keystone/pull/1407))
+- *(oauth2)* Populate id_token profile claims ([#1408](https://github.com/openstack-experimental/keystone/pull/1408))
+- *(oauth2)* Revoke refresh families on lifecycle ([#1404](https://github.com/openstack-experimental/keystone/pull/1404))
+- *(audit)* Fix initiator and outcome fidelity ([#1387](https://github.com/openstack-experimental/keystone/pull/1387))
+- *(audit)* Audit remaining provider mutations ([#1386](https://github.com/openstack-experimental/keystone/pull/1386))
+- *(oauth2)* Add RFC 7009 token revocation endpoint ([#1369](https://github.com/openstack-experimental/keystone/pull/1369))
+- *(oauth2)* Cap refresh families and revalidate user ([#1360](https://github.com/openstack-experimental/keystone/pull/1360))
+- *(oauth2-session)* Add expired record janitor ([#1359](https://github.com/openstack-experimental/keystone/pull/1359))
+- Hot-reload fs per-domain config files ([#1225](https://github.com/openstack-experimental/keystone/pull/1225))
+- *(adr0034)* Route assignment ops per domain ([#1219](https://github.com/openstack-experimental/keystone/pull/1219))
+- *(adr0034)* Build per-instance assignment backends ([#1218](https://github.com/openstack-experimental/keystone/pull/1218))
+- *(adr0034)* Add per-domain driver config surface ([#1216](https://github.com/openstack-experimental/keystone/pull/1216))
+- Resolve local/public ids for non-default backends ([#1207](https://github.com/openstack-experimental/keystone/pull/1207))
+- *(assignment)* Add OpenFGA assignment driver ([#1206](https://github.com/openstack-experimental/keystone/pull/1206))
+- *(idmapping)* Add id-mapping write paths ([#1205](https://github.com/openstack-experimental/keystone/pull/1205))
+- *(domain-config)* Dispatch identity ops per domain ([#1202](https://github.com/openstack-experimental/keystone/pull/1202))
+- *(domain-config)* Add resolution layer ([#1199](https://github.com/openstack-experimental/keystone/pull/1199))
+- *(domain-config)* Add filesystem driver ([#1197](https://github.com/openstack-experimental/keystone/pull/1197))
+- Add vendor data JWT API for SPIRE integration ([#1192](https://github.com/openstack-experimental/keystone/pull/1192))
+- Add domain config SQL driver ([#1139](https://github.com/openstack-experimental/keystone/pull/1139))
+- *(policy)* Implement legacy Policy API (/v3/policies) ([#1127](https://github.com/openstack-experimental/keystone/pull/1127))
+- Add domain config types and backend trait ([#1138](https://github.com/openstack-experimental/keystone/pull/1138))
+- Add cargo-fuzz targets ([#1130](https://github.com/openstack-experimental/keystone/pull/1130))
+- Add OS-EP-FILTER provider CRUD to the catalog ([#1075](https://github.com/openstack-experimental/keystone/pull/1075))
+- *(pagination)* Add pagination to remaining places ([#1106](https://github.com/openstack-experimental/keystone/pull/1106))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(identity)* Add trust create/delete and REST CRUD ([#1079](https://github.com/openstack-experimental/keystone/pull/1079))
+- *(catalog)* Expose /v3/regions REST API ([#1078](https://github.com/openstack-experimental/keystone/pull/1078))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- *(ldap)* Add LDAP identity driver ([#1047](https://github.com/openstack-experimental/keystone/pull/1047))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- Add catalog CRUD API and bootstrap support ([#1029](https://github.com/openstack-experimental/keystone/pull/1029))
+- *(adr0026)* Add RFC 8628 Device Authorization Grant ([#1023](https://github.com/openstack-experimental/keystone/pull/1023))
+- *(adr0026)* Phase 6a ([#1017](https://github.com/openstack-experimental/keystone/pull/1017))
+- *(adr0026)* Add Phase 5 offline token verification ([#1016](https://github.com/openstack-experimental/keystone/pull/1016))
+- *(adr0026)* Add authorization code flow with PKCE ([#1015](https://github.com/openstack-experimental/keystone/pull/1015))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 2 client registration & OIDC discovery ([#1013](https://github.com/openstack-experimental/keystone/pull/1013))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(identity)* Add per-user auth rate limiting ([#996](https://github.com/openstack-experimental/keystone/pull/996))
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
+- *(api)* Add global IP rate limiting framework (ADR-0022 phase 1) ([#846](https://github.com/openstack-experimental/keystone/pull/846))
+- *(adr0025)* Phase 1 (1.1+1.2) ([#952](https://github.com/openstack-experimental/keystone/pull/952))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 4 (protocol surface completion) ([#929](https://github.com/openstack-experimental/keystone/pull/929))
+- *(scim)* ADR 0024 - Phase 3 ([#928](https://github.com/openstack-experimental/keystone/pull/928))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- *(credential)* Implement ADR 0019 phases 1-2 ([#897](https://github.com/openstack-experimental/keystone/pull/897))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- Audit framework (ADR-0023) phase 3 ([#880](https://github.com/openstack-experimental/keystone/pull/880))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- Migrate federation to new mapping engine ([#839](https://github.com/openstack-experimental/keystone/pull/839))
+- Add access rule CRD to appcred provider ([#806](https://github.com/openstack-experimental/keystone/pull/806))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add endpoint CRUD to catalog provider ([#785](https://github.com/openstack-experimental/keystone/pull/785))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add service CRUD to the catalog provider ([#773](https://github.com/openstack-experimental/keystone/pull/773))
+- Validate password for compliance conformity ([#774](https://github.com/openstack-experimental/keystone/pull/774))
+- Return 401 on roleless scoped contexts ([#742](https://github.com/openstack-experimental/keystone/pull/742))
+- Add region CRUD to catalog SQL driver ([#761](https://github.com/openstack-experimental/keystone/pull/761))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add role imply API ([#749](https://github.com/openstack-experimental/keystone/pull/749))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Add spiffe binding API ([#740](https://github.com/openstack-experimental/keystone/pull/740))
+- Add Admin interface over the UDS ([#735](https://github.com/openstack-experimental/keystone/pull/735))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Expand role info in `expand_implied_roles` ([#730](https://github.com/openstack-experimental/keystone/pull/730))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(application_credential)* Accept tempest create payloads ([#1446](https://github.com/openstack-experimental/keystone/pull/1446))
+- *(oauth2)* Revoke refresh families on client delete/disable ([#1363](https://github.com/openstack-experimental/keystone/pull/1363))
+- *(oauth2-session)* Tombstone revoked refresh families ([#1358](https://github.com/openstack-experimental/keystone/pull/1358))
+- Next round of security review fixes ([#1241](https://github.com/openstack-experimental/keystone/pull/1241))
+- Use proper token issued_at time ([#1194](https://github.com/openstack-experimental/keystone/pull/1194))
+- Register UserType in OpenAPI components schema ([#1151](https://github.com/openstack-experimental/keystone/pull/1151))
+- Fix ID sanitizer and capture client IP in audit ([#1126](https://github.com/openstack-experimental/keystone/pull/1126))
+- *(api)* Default enabled/domain_id on create ([#1073](https://github.com/openstack-experimental/keystone/pull/1073))
+- *(security)* Address security review findings ([#1049](https://github.com/openstack-experimental/keystone/pull/1049))
+- *(federation)* Allow long external unique_id values ([#1033](https://github.com/openstack-experimental/keystone/pull/1033))
+- Unify ApiClient scope validation, fix nextest filter ([#947](https://github.com/openstack-experimental/keystone/pull/947))
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+- Resolve raft replication state races ([#884](https://github.com/openstack-experimental/keystone/pull/884))
+- *(k8s_auth)* Flatten k8s.aud claim from JWT TokenReview ([#834](https://github.com/openstack-experimental/keystone/pull/834))
+- Align "extra" property handling ([#787](https://github.com/openstack-experimental/keystone/pull/787))
+
+### Other
+
+- Feature/system assignment group ([#796](https://github.com/openstack-experimental/keystone/pull/796))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(api)* Harden v3 authorization and authentication coverage ([#1166](https://github.com/openstack-experimental/keystone/pull/1166))
+- *(identity)* Remove service account API methods ([#1152](https://github.com/openstack-experimental/keystone/pull/1152))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- Revise documentation layout ([#1069](https://github.com/openstack-experimental/keystone/pull/1069))
+- *(security)* Close mutation-testing gaps in auth/policy ([#1056](https://github.com/openstack-experimental/keystone/pull/1056))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- Unify state initialization in test ([#642](https://github.com/openstack-experimental/keystone/pull/642))
+- Small optimization of the derives ([#638](https://github.com/openstack-experimental/keystone/pull/638))
+- Split the core-types crate ([#640](https://github.com/openstack-experimental/keystone/pull/640))
diff --git a/crates/core/CHANGELOG.md b/crates/core/CHANGELOG.md
new file mode 100644
index 000000000..ed20d2fad
--- /dev/null
+++ b/crates/core/CHANGELOG.md
@@ -0,0 +1,217 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.2](https://github.com/openstack-experimental/keystone/compare/openstack-keystone-core-v0.1.1...openstack-keystone-core-v0.1.2) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Use control-plane aud for tokens ([#1498](https://github.com/openstack-experimental/keystone/pull/1498))
+- *(oauth2)* Add back-channel logout ([#1493](https://github.com/openstack-experimental/keystone/pull/1493))
+- *(oauth2)* Add federated sign-in to device page ([#1491](https://github.com/openstack-experimental/keystone/pull/1491))
+- *(oauth2)* Harden SSO sessions ([#1490](https://github.com/openstack-experimental/keystone/pull/1490))
+- *(oauth2)* Remember consent per client ([#1476](https://github.com/openstack-experimental/keystone/pull/1476))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add federated sign-in to OP login ([#1474](https://github.com/openstack-experimental/keystone/pull/1474))
+- *(oauth2)* Add TOTP second factor to OP login ([#1473](https://github.com/openstack-experimental/keystone/pull/1473))
+- *(oauth2)* Add client display metadata ([#1472](https://github.com/openstack-experimental/keystone/pull/1472))
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oauth2)* Add OIDC userinfo endpoint ([#1442](https://github.com/openstack-experimental/keystone/pull/1442))
+- *(oauth2)* Rotate signing keys automatically ([#1440](https://github.com/openstack-experimental/keystone/pull/1440))
+- *(oauth2)* Add RFC 7662 token introspection ([#1439](https://github.com/openstack-experimental/keystone/pull/1439))
+- Implement authc by app credential ([#1187](https://github.com/openstack-experimental/keystone/pull/1187))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(cadf)* Use DSP0262 names on the wire ([#1419](https://github.com/openstack-experimental/keystone/pull/1419))
+- *(limit)* Add unified limits ([#1407](https://github.com/openstack-experimental/keystone/pull/1407))
+- *(oauth2)* Populate id_token profile claims ([#1408](https://github.com/openstack-experimental/keystone/pull/1408))
+- *(oauth2)* Revoke refresh families on lifecycle ([#1404](https://github.com/openstack-experimental/keystone/pull/1404))
+- *(audit)* Align audit schema and vectors ([#1389](https://github.com/openstack-experimental/keystone/pull/1389))
+- *(audit)* Add perimeter completion record ([#1388](https://github.com/openstack-experimental/keystone/pull/1388))
+- *(audit)* Fix initiator and outcome fidelity ([#1387](https://github.com/openstack-experimental/keystone/pull/1387))
+- *(audit)* Audit remaining provider mutations ([#1386](https://github.com/openstack-experimental/keystone/pull/1386))
+- *(oauth2)* Add RFC 7009 token revocation endpoint ([#1369](https://github.com/openstack-experimental/keystone/pull/1369))
+- *(oauth2)* Cap refresh families and revalidate user ([#1360](https://github.com/openstack-experimental/keystone/pull/1360))
+- *(oauth2-session)* Add expired record janitor ([#1359](https://github.com/openstack-experimental/keystone/pull/1359))
+- *(oauth2)* Add secondary indexes to raft driver ([#1327](https://github.com/openstack-experimental/keystone/pull/1327))
+- Hot-reload fs per-domain config files ([#1225](https://github.com/openstack-experimental/keystone/pull/1225))
+- *(adr0034)* Reload assignment bundle on config change ([#1220](https://github.com/openstack-experimental/keystone/pull/1220))
+- *(adr0034)* Route assignment ops per domain ([#1219](https://github.com/openstack-experimental/keystone/pull/1219))
+- *(adr0034)* Build per-instance assignment backends ([#1218](https://github.com/openstack-experimental/keystone/pull/1218))
+- *(adr0034)* Gate sources on domain_config ([#1217](https://github.com/openstack-experimental/keystone/pull/1217))
+- Resolve local/public ids for non-default backends ([#1207](https://github.com/openstack-experimental/keystone/pull/1207))
+- *(assignment)* Add OpenFGA assignment driver ([#1206](https://github.com/openstack-experimental/keystone/pull/1206))
+- *(idmapping)* Add id-mapping write paths ([#1205](https://github.com/openstack-experimental/keystone/pull/1205))
+- *(domain-config)* Dispatch identity ops per domain ([#1202](https://github.com/openstack-experimental/keystone/pull/1202))
+- *(domain-config)* Add configuration API ([#1201](https://github.com/openstack-experimental/keystone/pull/1201))
+- *(domain-config)* Add resolution layer ([#1199](https://github.com/openstack-experimental/keystone/pull/1199))
+- *(spiffe)* Derive spiffe claims ([#1193](https://github.com/openstack-experimental/keystone/pull/1193))
+- Add vendor data JWT API for SPIRE integration ([#1192](https://github.com/openstack-experimental/keystone/pull/1192))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(metrics)* Add shared Prometheus primitives crate ([#1186](https://github.com/openstack-experimental/keystone/pull/1186))
+- Add domain config SQL driver ([#1139](https://github.com/openstack-experimental/keystone/pull/1139))
+- *(policy)* Implement legacy Policy API (/v3/policies) ([#1127](https://github.com/openstack-experimental/keystone/pull/1127))
+- Add domain config types and backend trait ([#1138](https://github.com/openstack-experimental/keystone/pull/1138))
+- Add SCIM scenarios; Fix findings ([#1136](https://github.com/openstack-experimental/keystone/pull/1136))
+- Add cargo-fuzz targets ([#1130](https://github.com/openstack-experimental/keystone/pull/1130))
+- Add SPIFFE SVID health check to readiness probe ([#1121](https://github.com/openstack-experimental/keystone/pull/1121))
+- Add OS-EP-FILTER provider CRUD to the catalog ([#1075](https://github.com/openstack-experimental/keystone/pull/1075))
+- Add per-request cache framework (ADR 0030) ([#1114](https://github.com/openstack-experimental/keystone/pull/1114))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- *(config)* Revoke Vault token on shutdown ([#1088](https://github.com/openstack-experimental/keystone/pull/1088))
+- *(identity)* Add trust create/delete and REST CRUD ([#1079](https://github.com/openstack-experimental/keystone/pull/1079))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- *(tempest)* Improve tempest testing ([#1046](https://github.com/openstack-experimental/keystone/pull/1046))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- *(adr0026)* Add RFC 8628 Device Authorization Grant ([#1023](https://github.com/openstack-experimental/keystone/pull/1023))
+- *(adr0026)* Add previous-key and JTI-revocation janitor ([#1021](https://github.com/openstack-experimental/keystone/pull/1021))
+- *(adr0026)* Phase 6a ([#1017](https://github.com/openstack-experimental/keystone/pull/1017))
+- *(adr0026)* Add Phase 5 offline token verification ([#1016](https://github.com/openstack-experimental/keystone/pull/1016))
+- *(adr0026)* Add authorization code flow with PKCE ([#1015](https://github.com/openstack-experimental/keystone/pull/1015))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 2 client registration & OIDC discovery ([#1013](https://github.com/openstack-experimental/keystone/pull/1013))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(api)* capture client IP via proxy headers & SPIFFE (#358 follow-up) ([#908](https://github.com/openstack-experimental/keystone/pull/908))
+- *(identity)* Add per-user auth rate limiting ([#996](https://github.com/openstack-experimental/keystone/pull/996))
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
+- *(api)* Add global IP rate limiting framework (ADR-0022 phase 1) ([#846](https://github.com/openstack-experimental/keystone/pull/846))
+- *(adr0025)* Phase 1 (1.1+1.2) ([#952](https://github.com/openstack-experimental/keystone/pull/952))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- *(scim)* ADR 0024 - Phase 4 (protocol surface completion) ([#929](https://github.com/openstack-experimental/keystone/pull/929))
+- *(scim)* ADR 0024 - Phase 3 ([#928](https://github.com/openstack-experimental/keystone/pull/928))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- *(credential)* Implement ADR 0019 phases 1-2 ([#897](https://github.com/openstack-experimental/keystone/pull/897))
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- *(audit)* Complete ADR-0023 audit implementation ([#887](https://github.com/openstack-experimental/keystone/pull/887))
+- *(storage)* Cert validity and SVID TTL enforcement ([#886](https://github.com/openstack-experimental/keystone/pull/886))
+- Audit framework (ADR-0023) phase 3 ([#880](https://github.com/openstack-experimental/keystone/pull/880))
+- *(auth)* Password hashing parity with Python Keystone ([#859](https://github.com/openstack-experimental/keystone/pull/859))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- Migrate federation to new mapping engine ([#839](https://github.com/openstack-experimental/keystone/pull/839))
+- Add access rule CRD to appcred provider ([#806](https://github.com/openstack-experimental/keystone/pull/806))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add endpoint CRUD to catalog provider ([#785](https://github.com/openstack-experimental/keystone/pull/785))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add service CRUD to the catalog provider ([#773](https://github.com/openstack-experimental/keystone/pull/773))
+- Validate password for compliance conformity ([#774](https://github.com/openstack-experimental/keystone/pull/774))
+- Return 401 on roleless scoped contexts ([#742](https://github.com/openstack-experimental/keystone/pull/742))
+- Add region CRUD to catalog SQL driver ([#761](https://github.com/openstack-experimental/keystone/pull/761))
+- Add timing attack protection and failed auth tracking ([#758](https://github.com/openstack-experimental/keystone/pull/758))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add role imply API ([#749](https://github.com/openstack-experimental/keystone/pull/749))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Add domain CRUD operations ([#743](https://github.com/openstack-experimental/keystone/pull/743))
+- Add spiffe binding API ([#740](https://github.com/openstack-experimental/keystone/pull/740))
+- Normalize the policy enforcer structure ([#741](https://github.com/openstack-experimental/keystone/pull/741))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Add Admin interface over the UDS ([#735](https://github.com/openstack-experimental/keystone/pull/735))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Expand role info in `expand_implied_roles` ([#730](https://github.com/openstack-experimental/keystone/pull/730))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Talk to OPA over unix socket ([#701](https://github.com/openstack-experimental/keystone/pull/701))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Add basic healthcheck endpoint ([#671](https://github.com/openstack-experimental/keystone/pull/671))
+- Make raft storage available through state ([#657](https://github.com/openstack-experimental/keystone/pull/657))
+
+### Fixed
+
+- *(oauth2)* Clear logout relying parties atomically ([#1496](https://github.com/openstack-experimental/keystone/pull/1496))
+- *(oauth2)* Pin issuer to public_endpoint ([#1436](https://github.com/openstack-experimental/keystone/pull/1436))
+- *(oauth2)* Check client on device grant redeem ([#1435](https://github.com/openstack-experimental/keystone/pull/1435))
+- *(audit)* Polish the CADF crate ([#1424](https://github.com/openstack-experimental/keystone/pull/1424))
+- *(audit)* Keep request context in WASM host calls ([#1414](https://github.com/openstack-experimental/keystone/pull/1414))
+- *(audit)* Record variant names as reasons ([#1384](https://github.com/openstack-experimental/keystone/pull/1384))
+- *(oauth2)* Check refresh token owner before redemption ([#1364](https://github.com/openstack-experimental/keystone/pull/1364))
+- *(oauth2)* Revoke refresh families on client delete/disable ([#1363](https://github.com/openstack-experimental/keystone/pull/1363))
+- *(oauth2-session)* Tombstone revoked refresh families ([#1358](https://github.com/openstack-experimental/keystone/pull/1358))
+- *(deps)* Bump p256 to 0.14, unpin rand_core ([#1247](https://github.com/openstack-experimental/keystone/pull/1247))
+- Match real app-cred id field in route plugin ([#1242](https://github.com/openstack-experimental/keystone/pull/1242))
+- Next round of security review fixes ([#1241](https://github.com/openstack-experimental/keystone/pull/1241))
+- *(adr0034)* Post implementation fixes ([#1223](https://github.com/openstack-experimental/keystone/pull/1223))
+- Use proper token issued_at time ([#1194](https://github.com/openstack-experimental/keystone/pull/1194))
+- *(logging)* Surface 5xx causes at error level ([#1172](https://github.com/openstack-experimental/keystone/pull/1172))
+- Register UserType in OpenAPI components schema ([#1151](https://github.com/openstack-experimental/keystone/pull/1151))
+- *(api)* Fix pagination limit, filters, and rows ([#1115](https://github.com/openstack-experimental/keystone/pull/1115))
+- Fix ID sanitizer and capture client IP in audit ([#1126](https://github.com/openstack-experimental/keystone/pull/1126))
+- *(api)* Default enabled/domain_id on create ([#1073](https://github.com/openstack-experimental/keystone/pull/1073))
+- *(security)* Do not allow ec2cred token to do anything ([#1071](https://github.com/openstack-experimental/keystone/pull/1071))
+- *(security)* Address security review findings ([#1049](https://github.com/openstack-experimental/keystone/pull/1049))
+- *(adr0026)* Bind Token Exchange grant to the issuing domain ([#1019](https://github.com/openstack-experimental/keystone/pull/1019))
+- Unify ApiClient scope validation, fix nextest filter ([#947](https://github.com/openstack-experimental/keystone/pull/947))
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+- Resolve raft replication state races ([#884](https://github.com/openstack-experimental/keystone/pull/884))
+- *(core)* Eliminate mapping race condition ([#876](https://github.com/openstack-experimental/keystone/pull/876))
+- *(k8s_auth)* Flatten k8s.aud claim from JWT TokenReview ([#834](https://github.com/openstack-experimental/keystone/pull/834))
+- *(auth)* Close admin SVID impersonation gap ([#833](https://github.com/openstack-experimental/keystone/pull/833))
+
+### Other
+
+- Feature/system assignment group ([#796](https://github.com/openstack-experimental/keystone/pull/796))
+- *(limit)* Extend unified limits API coverage ([#1426](https://github.com/openstack-experimental/keystone/pull/1426))
+- *(audit)* Cover startup seal, quarantine, hooks ([#1410](https://github.com/openstack-experimental/keystone/pull/1410))
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
+- *(audit)* Cover spool, rotation and hook paths ([#1391](https://github.com/openstack-experimental/keystone/pull/1391))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(adr0034)* Add per-domain assignment driver tests ([#1222](https://github.com/openstack-experimental/keystone/pull/1222))
+- *(deps)* Bump argon2 from 0.5.3 to 0.6.0 ([#1184](https://github.com/openstack-experimental/keystone/pull/1184))
+- *(identity)* Remove service account API methods ([#1152](https://github.com/openstack-experimental/keystone/pull/1152))
+- Feature/expose app credential ([#948](https://github.com/openstack-experimental/keystone/pull/948))
+- *(api)* Expand v3 coverage and enforce EC2 token restrictions ([#1084](https://github.com/openstack-experimental/keystone/pull/1084))
+- Split extism out of core's dependency tree ([#1148](https://github.com/openstack-experimental/keystone/pull/1148))
+- Add SECURITY note to important method ([#1132](https://github.com/openstack-experimental/keystone/pull/1132))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(db)* 3 optimizations for DB queries ([#1111](https://github.com/openstack-experimental/keystone/pull/1111))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Revise documentation layout ([#1069](https://github.com/openstack-experimental/keystone/pull/1069))
+- *(security)* Close mutation-testing gaps in auth/policy ([#1056](https://github.com/openstack-experimental/keystone/pull/1056))
+- Extract password hashing into own crate ([#1055](https://github.com/openstack-experimental/keystone/pull/1055))
+- *(test)* Improve testing of the oauth2 OP ([#1024](https://github.com/openstack-experimental/keystone/pull/1024))
+- *(deps)* bump scrypt from 0.11.0 to 0.12.0 ([#923](https://github.com/openstack-experimental/keystone/pull/923))
+- Reorganize dockerfile and deps ([#857](https://github.com/openstack-experimental/keystone/pull/857))
+- *(core)* Remove spiffe crate dependency ([#858](https://github.com/openstack-experimental/keystone/pull/858))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- *(core)* Eliminate XxxProvider enums ([#830](https://github.com/openstack-experimental/keystone/pull/830))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- *(deps)* bump hmac from 0.12.1 to 0.13.0 ([#801](https://github.com/openstack-experimental/keystone/pull/801))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Consolidate password update flows ([#778](https://github.com/openstack-experimental/keystone/pull/778))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- *(deps)* bump jsonwebtoken from 10.3.0 to 10.4.0 ([#707](https://github.com/openstack-experimental/keystone/pull/707))
+- Introduce dynamic plugins ([#643](https://github.com/openstack-experimental/keystone/pull/643))
+- Small optimization of the derives ([#638](https://github.com/openstack-experimental/keystone/pull/638))
+- Split the core-types crate ([#640](https://github.com/openstack-experimental/keystone/pull/640))
+- Split out remaining sql drivers ([#633](https://github.com/openstack-experimental/keystone/pull/633))
+- Split more drivers to separate crates ([#632](https://github.com/openstack-experimental/keystone/pull/632))
+- Drop unnecessary derives to help compilation ([#631](https://github.com/openstack-experimental/keystone/pull/631))
+- Drop unnecessary tracing directives ([#627](https://github.com/openstack-experimental/keystone/pull/627))
+- Split config into standalone crate ([#628](https://github.com/openstack-experimental/keystone/pull/628))
+- Rework http client pool ([#629](https://github.com/openstack-experimental/keystone/pull/629))
+- Make assignment sql driver a standalone crate ([#626](https://github.com/openstack-experimental/keystone/pull/626))
+- Move assignment parameters resolution to driver ([#625](https://github.com/openstack-experimental/keystone/pull/625))
+- Introduce features in api-types crate ([#624](https://github.com/openstack-experimental/keystone/pull/624))
+- Slim down api-types crate ([#622](https://github.com/openstack-experimental/keystone/pull/622))
+- Split out webauthn into crate ([#621](https://github.com/openstack-experimental/keystone/pull/621))
+- Split out token-fernet driver ([#620](https://github.com/openstack-experimental/keystone/pull/620))
+- Prepare slit out of the FernetTokenProvider ([#619](https://github.com/openstack-experimental/keystone/pull/619))
+- Move benchmark into the proper crate ([#614](https://github.com/openstack-experimental/keystone/pull/614))
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index 2de4393e1..73e0a4775 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "openstack-keystone-core"
 description = "OpenStack Keystone service"
-version = "0.1.1"
+version = "0.1.2"
 rust-version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/credential-driver-sql/CHANGELOG.md b/crates/credential-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..41c4a0b7c
--- /dev/null
+++ b/crates/credential-driver-sql/CHANGELOG.md
@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-credential-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- *(credential)* Enforce Null Key check at startup ([#913](https://github.com/openstack-experimental/keystone/pull/913))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- *(credential)* Implement ADR 0019 phases 1-2 ([#897](https://github.com/openstack-experimental/keystone/pull/897))
+
+### Fixed
+
+- Widen Fernet key index from i8 to u32 ([#1080](https://github.com/openstack-experimental/keystone/pull/1080))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
diff --git a/crates/domain-config-driver-fs/CHANGELOG.md b/crates/domain-config-driver-fs/CHANGELOG.md
new file mode 100644
index 000000000..eaff9b216
--- /dev/null
+++ b/crates/domain-config-driver-fs/CHANGELOG.md
@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-domain-config-driver-fs-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- Hot-reload fs per-domain config files ([#1225](https://github.com/openstack-experimental/keystone/pull/1225))
+- *(adr0034)* Gate sources on domain_config ([#1217](https://github.com/openstack-experimental/keystone/pull/1217))
+- *(adr0034)* Add per-domain driver config surface ([#1216](https://github.com/openstack-experimental/keystone/pull/1216))
+- *(domain-config)* Add filesystem driver ([#1197](https://github.com/openstack-experimental/keystone/pull/1197))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
diff --git a/crates/domain-config-driver-sql/CHANGELOG.md b/crates/domain-config-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..3b6c4fe0d
--- /dev/null
+++ b/crates/domain-config-driver-sql/CHANGELOG.md
@@ -0,0 +1,26 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-domain-config-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(adr0034)* Gate sources on domain_config ([#1217](https://github.com/openstack-experimental/keystone/pull/1217))
+- *(adr0034)* Add per-domain driver config surface ([#1216](https://github.com/openstack-experimental/keystone/pull/1216))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Add domain config SQL driver ([#1139](https://github.com/openstack-experimental/keystone/pull/1139))
+
+### Fixed
+
+- *(logging)* Surface 5xx causes at error level ([#1172](https://github.com/openstack-experimental/keystone/pull/1172))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
diff --git a/crates/federation-driver-sql/CHANGELOG.md b/crates/federation-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..51478f0aa
--- /dev/null
+++ b/crates/federation-driver-sql/CHANGELOG.md
@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-federation-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- Migrate federation to new mapping engine ([#839](https://github.com/openstack-experimental/keystone/pull/839))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Other
+
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
diff --git a/crates/identity-driver-ldap/CHANGELOG.md b/crates/identity-driver-ldap/CHANGELOG.md
new file mode 100644
index 000000000..f52e6f486
--- /dev/null
+++ b/crates/identity-driver-ldap/CHANGELOG.md
@@ -0,0 +1,24 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-identity-driver-ldap-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(identity)* Add enabled filter to user list ([#1451](https://github.com/openstack-experimental/keystone/pull/1451))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(domain-config)* Dispatch identity ops per domain ([#1202](https://github.com/openstack-experimental/keystone/pull/1202))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(ldap)* Add LDAP identity driver ([#1047](https://github.com/openstack-experimental/keystone/pull/1047))
+
+### Other
+
+- *(identity)* Remove service account API methods ([#1152](https://github.com/openstack-experimental/keystone/pull/1152))
+- *(security)* Close mutation-testing gaps in auth/policy ([#1056](https://github.com/openstack-experimental/keystone/pull/1056))
diff --git a/crates/identity-driver-sql/CHANGELOG.md b/crates/identity-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..77e096b59
--- /dev/null
+++ b/crates/identity-driver-sql/CHANGELOG.md
@@ -0,0 +1,54 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-identity-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(identity)* Add enabled filter to user list ([#1451](https://github.com/openstack-experimental/keystone/pull/1451))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(metrics)* Add shared Prometheus primitives crate ([#1186](https://github.com/openstack-experimental/keystone/pull/1186))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(identity)* Add per-user auth rate limiting ([#996](https://github.com/openstack-experimental/keystone/pull/996))
+- *(identity)* Implement user password change endpoint ([#970](https://github.com/openstack-experimental/keystone/pull/970))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- *(scim)* ADR 0024 - Phase 3 ([#928](https://github.com/openstack-experimental/keystone/pull/928))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(auth)* Password hashing parity with Python Keystone ([#859](https://github.com/openstack-experimental/keystone/pull/859))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add timing attack protection and failed auth tracking ([#758](https://github.com/openstack-experimental/keystone/pull/758))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- *(api)* Default enabled/domain_id on create ([#1073](https://github.com/openstack-experimental/keystone/pull/1073))
+- *(federation)* Allow long external unique_id values ([#1033](https://github.com/openstack-experimental/keystone/pull/1033))
+- *(identity)* Support federated existence checks ([#1012](https://github.com/openstack-experimental/keystone/pull/1012))
+- Validate password complexity before storing password ([#845](https://github.com/openstack-experimental/keystone/pull/845))
+- Align "extra" property handling ([#787](https://github.com/openstack-experimental/keystone/pull/787))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(identity)* Remove service account API methods ([#1152](https://github.com/openstack-experimental/keystone/pull/1152))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(db)* 3 optimizations for DB queries ([#1111](https://github.com/openstack-experimental/keystone/pull/1111))
+- Switch user_list to 4t join ([#1108](https://github.com/openstack-experimental/keystone/pull/1108))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Extract password hashing into own crate ([#1055](https://github.com/openstack-experimental/keystone/pull/1055))
+- Silence some clippy warnings ([#1030](https://github.com/openstack-experimental/keystone/pull/1030))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Consolidate password update flows ([#778](https://github.com/openstack-experimental/keystone/pull/778))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
diff --git a/crates/idmapping-driver-sql/CHANGELOG.md b/crates/idmapping-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..e24726d49
--- /dev/null
+++ b/crates/idmapping-driver-sql/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-idmapping-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Resolve local/public ids for non-default backends ([#1207](https://github.com/openstack-experimental/keystone/pull/1207))
+- *(idmapping)* Add id-mapping write paths ([#1205](https://github.com/openstack-experimental/keystone/pull/1205))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+
+### Other
+
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
diff --git a/crates/k8s-auth-driver-raft/CHANGELOG.md b/crates/k8s-auth-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..236b507a3
--- /dev/null
+++ b/crates/k8s-auth-driver-raft/CHANGELOG.md
@@ -0,0 +1,26 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-k8s-auth-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Other
+
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- Update raft drivers mocking ([#791](https://github.com/openstack-experimental/keystone/pull/791))
+- Add mock raft storage for unittest ([#790](https://github.com/openstack-experimental/keystone/pull/790))
diff --git a/crates/k8s-auth-driver-sql/CHANGELOG.md b/crates/k8s-auth-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..cf1e16a6e
--- /dev/null
+++ b/crates/k8s-auth-driver-sql/CHANGELOG.md
@@ -0,0 +1,26 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-k8s-auth-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Other
+
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
diff --git a/crates/key-repository/CHANGELOG.md b/crates/key-repository/CHANGELOG.md
new file mode 100644
index 000000000..35a4413d0
--- /dev/null
+++ b/crates/key-repository/CHANGELOG.md
@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-key-repository-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(adr0026)* Add previous-key and JTI-revocation janitor ([#1021](https://github.com/openstack-experimental/keystone/pull/1021))
+- *(adr0026)* Add Phase 5 offline token verification ([#1016](https://github.com/openstack-experimental/keystone/pull/1016))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+
+### Fixed
+
+- *(deps)* Bump p256 to 0.14, unpin rand_core ([#1247](https://github.com/openstack-experimental/keystone/pull/1247))
+- Widen Fernet key index from i8 to u32 ([#1080](https://github.com/openstack-experimental/keystone/pull/1080))
+- Support macOS dev builds and fs watcher shutdown ([#1009](https://github.com/openstack-experimental/keystone/pull/1009))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(deps)* bump pem from 3.0.6 to 4.0.0 ([#1162](https://github.com/openstack-experimental/keystone/pull/1162))
+- *(deps)* bump pkcs8 from 0.10.2 to 0.11.0 ([#1061](https://github.com/openstack-experimental/keystone/pull/1061))
diff --git a/crates/keystone/CHANGELOG.md b/crates/keystone/CHANGELOG.md
new file mode 100644
index 000000000..804eeb312
--- /dev/null
+++ b/crates/keystone/CHANGELOG.md
@@ -0,0 +1,273 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.2](https://github.com/openstack-experimental/keystone/compare/openstack-keystone-v0.1.1...openstack-keystone-v0.1.2) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Use control-plane aud for tokens ([#1498](https://github.com/openstack-experimental/keystone/pull/1498))
+- *(oauth2)* Add back-channel logout ([#1493](https://github.com/openstack-experimental/keystone/pull/1493))
+- *(oauth2)* Add WebAuthn second factor ([#1492](https://github.com/openstack-experimental/keystone/pull/1492))
+- *(oauth2)* Add federated sign-in to device page ([#1491](https://github.com/openstack-experimental/keystone/pull/1491))
+- *(oauth2)* Harden SSO sessions ([#1490](https://github.com/openstack-experimental/keystone/pull/1490))
+- *(oauth2)* Remember consent per client ([#1476](https://github.com/openstack-experimental/keystone/pull/1476))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add federated sign-in to OP login ([#1474](https://github.com/openstack-experimental/keystone/pull/1474))
+- *(oauth2)* Add TOTP second factor to OP login ([#1473](https://github.com/openstack-experimental/keystone/pull/1473))
+- *(oauth2)* Add client display metadata ([#1472](https://github.com/openstack-experimental/keystone/pull/1472))
+- *(oauth2)* Brand and localize the login pages ([#1471](https://github.com/openstack-experimental/keystone/pull/1471))
+- *(oauth2)* Add operator login page templates ([#1470](https://github.com/openstack-experimental/keystone/pull/1470))
+- *(k8s)* Add production overlay for Raft storage ([#1457](https://github.com/openstack-experimental/keystone/pull/1457))
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(identity)* Add user projects endpoint ([#1452](https://github.com/openstack-experimental/keystone/pull/1452))
+- *(storage)* Gate readiness on Raft health ([#1450](https://github.com/openstack-experimental/keystone/pull/1450))
+- *(oauth2)* Add OIDC userinfo endpoint ([#1442](https://github.com/openstack-experimental/keystone/pull/1442))
+- *(oauth2)* Add RFC 7662 token introspection ([#1439](https://github.com/openstack-experimental/keystone/pull/1439))
+- Implement authc by app credential ([#1187](https://github.com/openstack-experimental/keystone/pull/1187))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(cadf)* Use DSP0262 names on the wire ([#1419](https://github.com/openstack-experimental/keystone/pull/1419))
+- *(audit)* Add opt-in per-request perimeter record ([#1415](https://github.com/openstack-experimental/keystone/pull/1415))
+- *(limit)* Add unified limits ([#1407](https://github.com/openstack-experimental/keystone/pull/1407))
+- *(oauth2)* Populate id_token profile claims ([#1408](https://github.com/openstack-experimental/keystone/pull/1408))
+- *(oauth2)* Revoke refresh families on lifecycle ([#1404](https://github.com/openstack-experimental/keystone/pull/1404))
+- *(audit)* Ship raft audit spool through the sink ([#1383](https://github.com/openstack-experimental/keystone/pull/1383))
+- *(audit)* Add HMAC key rotation and node checks ([#1382](https://github.com/openstack-experimental/keystone/pull/1382))
+- *(audit)* Add an RFC 5424 syslog sink ([#1381](https://github.com/openstack-experimental/keystone/pull/1381))
+- *(audit)* Make channel and spool limits configurable ([#1380](https://github.com/openstack-experimental/keystone/pull/1380))
+- *(audit)* Align audit schema and vectors ([#1389](https://github.com/openstack-experimental/keystone/pull/1389))
+- *(audit)* Add perimeter completion record ([#1388](https://github.com/openstack-experimental/keystone/pull/1388))
+- *(audit)* Fix initiator and outcome fidelity ([#1387](https://github.com/openstack-experimental/keystone/pull/1387))
+- *(audit)* Audit remaining provider mutations ([#1386](https://github.com/openstack-experimental/keystone/pull/1386))
+- *(audit)* Export spool, sink and queue metrics ([#1385](https://github.com/openstack-experimental/keystone/pull/1385))
+- *(audit)* Add an enabled switch ([#1379](https://github.com/openstack-experimental/keystone/pull/1379))
+- *(audit)* Ship sealed spool segments to a sink ([#1374](https://github.com/openstack-experimental/keystone/pull/1374))
+- *(oauth2)* Add RFC 7009 token revocation endpoint ([#1369](https://github.com/openstack-experimental/keystone/pull/1369))
+- *(oauth2)* Cap refresh families and revalidate user ([#1360](https://github.com/openstack-experimental/keystone/pull/1360))
+- *(oauth2-session)* Add expired record janitor ([#1359](https://github.com/openstack-experimental/keystone/pull/1359))
+- *(raft)* Add backup restore ([#1352](https://github.com/openstack-experimental/keystone/pull/1352))
+- *(devstack)* Pilot ksm SPIFFE mTLS transport ([#1239](https://github.com/openstack-experimental/keystone/pull/1239))
+- *(adr0034)* Restrict the assignment DC group to admins ([#1221](https://github.com/openstack-experimental/keystone/pull/1221))
+- *(adr0034)* Reload assignment bundle on config change ([#1220](https://github.com/openstack-experimental/keystone/pull/1220))
+- *(adr0034)* Build per-instance assignment backends ([#1218](https://github.com/openstack-experimental/keystone/pull/1218))
+- *(assignment)* Add OpenFGA assignment driver ([#1206](https://github.com/openstack-experimental/keystone/pull/1206))
+- *(domain-config)* Dispatch identity ops per domain ([#1202](https://github.com/openstack-experimental/keystone/pull/1202))
+- *(domain-config)* Add configuration API ([#1201](https://github.com/openstack-experimental/keystone/pull/1201))
+- *(domain-config)* Add resolution layer ([#1199](https://github.com/openstack-experimental/keystone/pull/1199))
+- *(domain-config)* Add filesystem driver ([#1197](https://github.com/openstack-experimental/keystone/pull/1197))
+- *(spiffe)* Derive spiffe claims ([#1193](https://github.com/openstack-experimental/keystone/pull/1193))
+- Add vendor data JWT API for SPIRE integration ([#1192](https://github.com/openstack-experimental/keystone/pull/1192))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(metrics)* Add shared Prometheus primitives crate ([#1186](https://github.com/openstack-experimental/keystone/pull/1186))
+- *(api)* Log response body for all 4xx/5xx errors ([#1171](https://github.com/openstack-experimental/keystone/pull/1171))
+- Add domain config SQL driver ([#1139](https://github.com/openstack-experimental/keystone/pull/1139))
+- *(policy)* Implement legacy Policy API (/v3/policies) ([#1127](https://github.com/openstack-experimental/keystone/pull/1127))
+- *(adr0031)* Add HTTP request metrics ([#1134](https://github.com/openstack-experimental/keystone/pull/1134))
+- Filter user listing by type ([#813](https://github.com/openstack-experimental/keystone/pull/813))
+- *(loadtest)* Add more auth tests ([#1119](https://github.com/openstack-experimental/keystone/pull/1119))
+- *(config)* Support configurable log file rotation ([#1128](https://github.com/openstack-experimental/keystone/pull/1128))
+- Add SPIFFE SVID health check to readiness probe ([#1121](https://github.com/openstack-experimental/keystone/pull/1121))
+- *(server)* Fold uri/request-id into access log message ([#1118](https://github.com/openstack-experimental/keystone/pull/1118))
+- Add per-request cache framework (ADR 0030) ([#1114](https://github.com/openstack-experimental/keystone/pull/1114))
+- Add connection_debug to tune SQL query logging ([#1109](https://github.com/openstack-experimental/keystone/pull/1109))
+- *(pagination)* Add pagination to remaining places ([#1106](https://github.com/openstack-experimental/keystone/pull/1106))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(logging)* Add native journald log writer ([#1081](https://github.com/openstack-experimental/keystone/pull/1081))
+- *(identity)* Add trust create/delete and REST CRUD ([#1079](https://github.com/openstack-experimental/keystone/pull/1079))
+- *(catalog)* Expose /v3/regions REST API ([#1078](https://github.com/openstack-experimental/keystone/pull/1078))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- *(ldap)* Add LDAP identity driver ([#1047](https://github.com/openstack-experimental/keystone/pull/1047))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- Add catalog CRUD API and bootstrap support ([#1029](https://github.com/openstack-experimental/keystone/pull/1029))
+- *(adr0026)* Add RFC 8628 Device Authorization Grant ([#1023](https://github.com/openstack-experimental/keystone/pull/1023))
+- *(adr0026)* Add previous-key and JTI-revocation janitor ([#1021](https://github.com/openstack-experimental/keystone/pull/1021))
+- *(adr0026)* Extend keystone-manage oauth2 CLI ([#1020](https://github.com/openstack-experimental/keystone/pull/1020))
+- *(adr0026)* Phase 6a ([#1017](https://github.com/openstack-experimental/keystone/pull/1017))
+- *(adr0026)* Add Phase 5 offline token verification ([#1016](https://github.com/openstack-experimental/keystone/pull/1016))
+- *(adr0026)* Add authorization code flow with PKCE ([#1015](https://github.com/openstack-experimental/keystone/pull/1015))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 2 client registration & OIDC discovery ([#1013](https://github.com/openstack-experimental/keystone/pull/1013))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(api)* capture client IP via proxy headers & SPIFFE (#358 follow-up) ([#908](https://github.com/openstack-experimental/keystone/pull/908))
+- *(identity)* Add per-user auth rate limiting ([#996](https://github.com/openstack-experimental/keystone/pull/996))
+- *(adr0025)* Complete imlpementation ([#969](https://github.com/openstack-experimental/keystone/pull/969))
+- *(identity)* Implement user password change endpoint ([#970](https://github.com/openstack-experimental/keystone/pull/970))
+- Improve OPA subprocess start ([#972](https://github.com/openstack-experimental/keystone/pull/972))
+- *(api)* Add global IP rate limiting framework (ADR-0022 phase 1) ([#846](https://github.com/openstack-experimental/keystone/pull/846))
+- *(scim)* Harden RFC 7644 compliance, add docs ([#968](https://github.com/openstack-experimental/keystone/pull/968))
+- *(adr0025)* Phase 1 (1.1+1.2) ([#952](https://github.com/openstack-experimental/keystone/pull/952))
+- *(security)* Wrap secrets with secrecy crate ([#369](https://github.com/openstack-experimental/keystone/pull/369)) ([#912](https://github.com/openstack-experimental/keystone/pull/912))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- *(scim)* ADR 0024 - Phase 4 (protocol surface completion) ([#929](https://github.com/openstack-experimental/keystone/pull/929))
+- *(scim)* ADR 0024 - Phase 3 ([#928](https://github.com/openstack-experimental/keystone/pull/928))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- *(credential)* Enforce Null Key check at startup ([#913](https://github.com/openstack-experimental/keystone/pull/913))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- *(credential)* Implement ADR 0019 phases 1-2 ([#897](https://github.com/openstack-experimental/keystone/pull/897))
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- *(audit)* Complete ADR-0023 audit implementation ([#887](https://github.com/openstack-experimental/keystone/pull/887))
+- *(storage)* Cert validity and SVID TTL enforcement ([#886](https://github.com/openstack-experimental/keystone/pull/886))
+- Audit framework (ADR-0023) phase 3 ([#880](https://github.com/openstack-experimental/keystone/pull/880))
+- *(auth)* Password hashing parity with Python Keystone ([#859](https://github.com/openstack-experimental/keystone/pull/859))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Add SPIFFE mTLS support to Raft gRPC ([#852](https://github.com/openstack-experimental/keystone/pull/852))
+- Migrate federation to new mapping engine ([#839](https://github.com/openstack-experimental/keystone/pull/839))
+- *(api)* Capture client IP via ConnectInfo ([#842](https://github.com/openstack-experimental/keystone/pull/842))
+- *(api)* Normalize trailing slashes in paths ([#841](https://github.com/openstack-experimental/keystone/pull/841))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- *(mapping)* ADR-0020 phase 2 ([#807](https://github.com/openstack-experimental/keystone/pull/807))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add service CRUD to the catalog provider ([#773](https://github.com/openstack-experimental/keystone/pull/773))
+- Add SO_PEERCRED peer credential validation ([#775](https://github.com/openstack-experimental/keystone/pull/775))
+- Return 401 on roleless scoped contexts ([#742](https://github.com/openstack-experimental/keystone/pull/742))
+- Add system-user-role assignments API ([#762](https://github.com/openstack-experimental/keystone/pull/762))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Add api to list user roles on project ([#639](https://github.com/openstack-experimental/keystone/pull/639))
+- Add domain CRUD operations ([#743](https://github.com/openstack-experimental/keystone/pull/743))
+- Add spiffe binding API ([#740](https://github.com/openstack-experimental/keystone/pull/740))
+- Normalize the policy enforcer structure ([#741](https://github.com/openstack-experimental/keystone/pull/741))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Add keystone container with opa and policies ([#738](https://github.com/openstack-experimental/keystone/pull/738))
+- Add Admin interface over the UDS ([#735](https://github.com/openstack-experimental/keystone/pull/735))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Talk to OPA over unix socket ([#701](https://github.com/openstack-experimental/keystone/pull/701))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Add basic healthcheck endpoint ([#671](https://github.com/openstack-experimental/keystone/pull/671))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce raft backend for webauthn ([#658](https://github.com/openstack-experimental/keystone/pull/658))
+- Make raft storage available through state ([#657](https://github.com/openstack-experimental/keystone/pull/657))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(oauth2)* Clear logout relying parties atomically ([#1496](https://github.com/openstack-experimental/keystone/pull/1496))
+- *(resource)* Align domain and project response shape ([#1454](https://github.com/openstack-experimental/keystone/pull/1454))
+- *(application_credential)* Accept tempest create payloads ([#1446](https://github.com/openstack-experimental/keystone/pull/1446))
+- *(oauth2)* Pin issuer to public_endpoint ([#1436](https://github.com/openstack-experimental/keystone/pull/1436))
+- *(oauth2)* Check client on device grant redeem ([#1435](https://github.com/openstack-experimental/keystone/pull/1435))
+- *(oauth2)* Rate limit device_code token grant ([#1434](https://github.com/openstack-experimental/keystone/pull/1434))
+- *(oauth2)* Add no-store headers to OP responses ([#1432](https://github.com/openstack-experimental/keystone/pull/1432))
+- *(oauth2)* Correct discovery document metadata ([#1431](https://github.com/openstack-experimental/keystone/pull/1431))
+- *(cli-manage)* Pin admin client SVID to admin_svid ([#1428](https://github.com/openstack-experimental/keystone/pull/1428))
+- *(audit)* Polish the CADF crate ([#1424](https://github.com/openstack-experimental/keystone/pull/1424))
+- *(storage)* Authorize Raft and Storage gRPC callers ([#1418](https://github.com/openstack-experimental/keystone/pull/1418))
+- *(audit)* Record variant names as reasons ([#1384](https://github.com/openstack-experimental/keystone/pull/1384))
+- *(oauth2)* Check refresh token owner before redemption ([#1364](https://github.com/openstack-experimental/keystone/pull/1364))
+- *(oauth2)* Revoke refresh families on client delete/disable ([#1363](https://github.com/openstack-experimental/keystone/pull/1363))
+- *(oauth2-session)* Tombstone revoked refresh families ([#1358](https://github.com/openstack-experimental/keystone/pull/1358))
+- *(audit)* Stop spool replay from looping into itself ([#1350](https://github.com/openstack-experimental/keystone/pull/1350))
+- Match real app-cred id field in route plugin ([#1242](https://github.com/openstack-experimental/keystone/pull/1242))
+- Next round of security review fixes ([#1241](https://github.com/openstack-experimental/keystone/pull/1241))
+- *(adr0034)* Post implementation fixes ([#1223](https://github.com/openstack-experimental/keystone/pull/1223))
+- *(logging)* Surface 5xx causes at error level ([#1172](https://github.com/openstack-experimental/keystone/pull/1172))
+- *(audit)* Start spool writers before replay ([#1167](https://github.com/openstack-experimental/keystone/pull/1167))
+- *(policy)* Bind credential listing to own user ([#1154](https://github.com/openstack-experimental/keystone/pull/1154))
+- Register UserType in OpenAPI components schema ([#1151](https://github.com/openstack-experimental/keystone/pull/1151))
+- Map raft-not-available to proper HTTP status codes ([#1149](https://github.com/openstack-experimental/keystone/pull/1149))
+- *(api)* Fix pagination limit, filters, and rows ([#1115](https://github.com/openstack-experimental/keystone/pull/1115))
+- Fix ID sanitizer and capture client IP in audit ([#1126](https://github.com/openstack-experimental/keystone/pull/1126))
+- Increase startup health check timeout ([#1123](https://github.com/openstack-experimental/keystone/pull/1123))
+- Gate X-Forwarded-Proto behind enable_proxy_headers_parsing ([#1116](https://github.com/openstack-experimental/keystone/pull/1116))
+- Respect X-Forwarded-Proto in version discovery ([#1113](https://github.com/openstack-experimental/keystone/pull/1113))
+- *(log)* Fix loglevels of the file ([#1107](https://github.com/openstack-experimental/keystone/pull/1107))
+- Address multiple tempest failures ([#1083](https://github.com/openstack-experimental/keystone/pull/1083))
+- *(api)* Default enabled/domain_id on create ([#1073](https://github.com/openstack-experimental/keystone/pull/1073))
+- *(security)* Do not allow ec2cred token to do anything ([#1071](https://github.com/openstack-experimental/keystone/pull/1071))
+- Use PATCH for v3 update operations ([#1050](https://github.com/openstack-experimental/keystone/pull/1050))
+- *(security)* Address security review findings ([#1049](https://github.com/openstack-experimental/keystone/pull/1049))
+- *(oauth2)* Rate-limit device flow, grant-type check ([#1026](https://github.com/openstack-experimental/keystone/pull/1026))
+- *(adr0026)* Bind Token Exchange grant to the issuing domain ([#1019](https://github.com/openstack-experimental/keystone/pull/1019))
+- Support macOS dev builds and fs watcher shutdown ([#1009](https://github.com/openstack-experimental/keystone/pull/1009))
+- *(raft)* Gracefully handle start_raft_app errors ([#1007](https://github.com/openstack-experimental/keystone/pull/1007))
+- Pass resolved token to OPA policy checks ([#927](https://github.com/openstack-experimental/keystone/pull/927))
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+- Stop swagger-ui redirect loop, split main() ([#899](https://github.com/openstack-experimental/keystone/pull/899))
+- Resolve raft replication state races ([#884](https://github.com/openstack-experimental/keystone/pull/884))
+- ADR-0002 compliance for policy enforcement ([#882](https://github.com/openstack-experimental/keystone/pull/882))
+- *(k8s_auth)* Flatten k8s.aud claim from JWT TokenReview ([#834](https://github.com/openstack-experimental/keystone/pull/834))
+- *(auth)* Fix token-from-token auth bounds ([#810](https://github.com/openstack-experimental/keystone/pull/810))
+
+### Other
+
+- *(storage)* Cover bootstrap and auto-join ([#1502](https://github.com/openstack-experimental/keystone/pull/1502))
+- Feature/system assignment group ([#796](https://github.com/openstack-experimental/keystone/pull/796))
+- *(oauth2)* Assert audit records of token grants ([#1420](https://github.com/openstack-experimental/keystone/pull/1420))
+- *(audit)* Assert JWT and OIDC perimeter events ([#1412](https://github.com/openstack-experimental/keystone/pull/1412))
+- *(cadf)* Move audit startup into runtime ([#1406](https://github.com/openstack-experimental/keystone/pull/1406))
+- *(cadf)* Own the audit configuration ([#1405](https://github.com/openstack-experimental/keystone/pull/1405))
+- *(cadf)* Parameterize the service identity ([#1400](https://github.com/openstack-experimental/keystone/pull/1400))
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
+- *(audit)* Cover spool, rotation and hook paths ([#1391](https://github.com/openstack-experimental/keystone/pull/1391))
+- *(audit)* Cover spool flush on shutdown ([#1373](https://github.com/openstack-experimental/keystone/pull/1373))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(keystone)* Move bin startup into server::startup ([#1195](https://github.com/openstack-experimental/keystone/pull/1195))
+- *(api)* Harden v3 authorization and authentication coverage ([#1166](https://github.com/openstack-experimental/keystone/pull/1166))
+- Rename tracing params ([#1165](https://github.com/openstack-experimental/keystone/pull/1165))
+- *(api)* Cover v4 handlers and fix role assignment routing ([#1153](https://github.com/openstack-experimental/keystone/pull/1153))
+- Feature/expose app credential ([#948](https://github.com/openstack-experimental/keystone/pull/948))
+- *(api)* Expand v3 coverage and enforce EC2 token restrictions ([#1084](https://github.com/openstack-experimental/keystone/pull/1084))
+- Split extism out of core's dependency tree ([#1148](https://github.com/openstack-experimental/keystone/pull/1148))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Verify JWT tampering is rejected ([#1074](https://github.com/openstack-experimental/keystone/pull/1074))
+- Revise documentation layout ([#1069](https://github.com/openstack-experimental/keystone/pull/1069))
+- Add more debug info to main app start ([#1066](https://github.com/openstack-experimental/keystone/pull/1066))
+- Extract password hashing into own crate ([#1055](https://github.com/openstack-experimental/keystone/pull/1055))
+- Moves health and metrics endpoints to dedicated listener on separate port ([#910](https://github.com/openstack-experimental/keystone/pull/910))
+- *(test)* Improve testing of the oauth2 OP ([#1024](https://github.com/openstack-experimental/keystone/pull/1024))
+- Add more debug info for grpc app start ([#1008](https://github.com/openstack-experimental/keystone/pull/1008))
+- Silence WASM logging ([#1006](https://github.com/openstack-experimental/keystone/pull/1006))
+- *(ci)* Rework skaffold setup ([#871](https://github.com/openstack-experimental/keystone/pull/871))
+- Reorganize dockerfile and deps ([#857](https://github.com/openstack-experimental/keystone/pull/857))
+- *(core)* Remove spiffe crate dependency ([#858](https://github.com/openstack-experimental/keystone/pull/858))
+- Add SpiFFE Raft integration test by skaffold ([#854](https://github.com/openstack-experimental/keystone/pull/854))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- *(federation)* Drop openidconnect dependency ([#849](https://github.com/openstack-experimental/keystone/pull/849))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- *(tests)* Reorganize integration_api tests ([#815](https://github.com/openstack-experimental/keystone/pull/815))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- Upgrade spiffe dependencies ([#805](https://github.com/openstack-experimental/keystone/pull/805))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Unify sea-orm features ([#769](https://github.com/openstack-experimental/keystone/pull/769))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
+- Make core crates a workspace dependency ([#736](https://github.com/openstack-experimental/keystone/pull/736))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- *(deps)* bump spiffe ([#709](https://github.com/openstack-experimental/keystone/pull/709))
+- *(deps)* bump spiffe-rustls-tokio from 0.2.0 to 0.3.0 ([#706](https://github.com/openstack-experimental/keystone/pull/706))
+- Add policy enforcement into group.v3 handler ([#685](https://github.com/openstack-experimental/keystone/pull/685))
+- Split api.v3.group handlers ([#679](https://github.com/openstack-experimental/keystone/pull/679))
+- Small optimization of the derives ([#638](https://github.com/openstack-experimental/keystone/pull/638))
+- Split the core-types crate ([#640](https://github.com/openstack-experimental/keystone/pull/640))
+- Split out remaining sql drivers ([#633](https://github.com/openstack-experimental/keystone/pull/633))
+- Split more drivers to separate crates ([#632](https://github.com/openstack-experimental/keystone/pull/632))
+- Split config into standalone crate ([#628](https://github.com/openstack-experimental/keystone/pull/628))
+- Make assignment sql driver a standalone crate ([#626](https://github.com/openstack-experimental/keystone/pull/626))
+- Move assignment parameters resolution to driver ([#625](https://github.com/openstack-experimental/keystone/pull/625))
+- Introduce features in api-types crate ([#624](https://github.com/openstack-experimental/keystone/pull/624))
+- Slim down api-types crate ([#622](https://github.com/openstack-experimental/keystone/pull/622))
+- Split out webauthn into crate ([#621](https://github.com/openstack-experimental/keystone/pull/621))
+- Split out token-fernet driver ([#620](https://github.com/openstack-experimental/keystone/pull/620))
+- Prepare slit out of the FernetTokenProvider ([#619](https://github.com/openstack-experimental/keystone/pull/619))
+- Move benchmark into the proper crate ([#614](https://github.com/openstack-experimental/keystone/pull/614))
diff --git a/crates/keystone/Cargo.toml b/crates/keystone/Cargo.toml
index 449390c36..4db19e59a 100644
--- a/crates/keystone/Cargo.toml
+++ b/crates/keystone/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "openstack-keystone"
 description = "OpenStack Keystone service"
-version = "0.1.1"
+version = "0.1.2"
 build = "build.rs"
 rust-version.workspace = true
 edition.workspace = true
diff --git a/crates/limit-driver-sql/CHANGELOG.md b/crates/limit-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..d3eaaa2b5
--- /dev/null
+++ b/crates/limit-driver-sql/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-limit-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(limit)* Add unified limits ([#1407](https://github.com/openstack-experimental/keystone/pull/1407))
diff --git a/crates/local-emergency-store/CHANGELOG.md b/crates/local-emergency-store/CHANGELOG.md
new file mode 100644
index 000000000..b44f796fe
--- /dev/null
+++ b/crates/local-emergency-store/CHANGELOG.md
@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-local-emergency-store-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+
+### Other
+
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
diff --git a/crates/mapping-driver-raft/CHANGELOG.md b/crates/mapping-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..3c9d607cf
--- /dev/null
+++ b/crates/mapping-driver-raft/CHANGELOG.md
@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-mapping-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(pagination)* Add pagination to remaining places ([#1106](https://github.com/openstack-experimental/keystone/pull/1106))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(mapping)* ADR-0020 phase 2 ([#807](https://github.com/openstack-experimental/keystone/pull/807))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
diff --git a/crates/oauth2-client-driver-raft/CHANGELOG.md b/crates/oauth2-client-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..1ae633da8
--- /dev/null
+++ b/crates/oauth2-client-driver-raft/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-oauth2-client-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Add back-channel logout ([#1493](https://github.com/openstack-experimental/keystone/pull/1493))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add client display metadata ([#1472](https://github.com/openstack-experimental/keystone/pull/1472))
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(adr0026)* Phase 2 client registration & OIDC discovery ([#1013](https://github.com/openstack-experimental/keystone/pull/1013))
diff --git a/crates/oauth2-key-driver-raft/CHANGELOG.md b/crates/oauth2-key-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..6e8ce1da9
--- /dev/null
+++ b/crates/oauth2-key-driver-raft/CHANGELOG.md
@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-oauth2-key-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oauth2)* Rotate signing keys automatically ([#1440](https://github.com/openstack-experimental/keystone/pull/1440))
+- *(oauth2)* Add RFC 7009 token revocation endpoint ([#1369](https://github.com/openstack-experimental/keystone/pull/1369))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- *(adr0026)* Add previous-key and JTI-revocation janitor ([#1021](https://github.com/openstack-experimental/keystone/pull/1021))
+- *(adr0026)* Phase 6a ([#1017](https://github.com/openstack-experimental/keystone/pull/1017))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+
+### Fixed
+
+- *(tests)* Fix some test failures ([#1430](https://github.com/openstack-experimental/keystone/pull/1430))
+
+### Other
+
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
diff --git a/crates/oauth2-session-driver-raft/CHANGELOG.md b/crates/oauth2-session-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..3a837cbdd
--- /dev/null
+++ b/crates/oauth2-session-driver-raft/CHANGELOG.md
@@ -0,0 +1,39 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-oauth2-session-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(oauth2)* back-channel/front-channel logout and upstream IdP logout ([#1505](https://github.com/openstack-experimental/keystone/pull/1505))
+- *(oauth2)* Add back-channel logout ([#1493](https://github.com/openstack-experimental/keystone/pull/1493))
+- *(oauth2)* Add federated sign-in to device page ([#1491](https://github.com/openstack-experimental/keystone/pull/1491))
+- *(oauth2)* Harden SSO sessions ([#1490](https://github.com/openstack-experimental/keystone/pull/1490))
+- *(oauth2)* Remember consent per client ([#1476](https://github.com/openstack-experimental/keystone/pull/1476))
+- *(oauth2)* Add SSO session and RP logout ([#1475](https://github.com/openstack-experimental/keystone/pull/1475))
+- *(oauth2)* Add federated sign-in to OP login ([#1474](https://github.com/openstack-experimental/keystone/pull/1474))
+- *(oauth2)* Add TOTP second factor to OP login ([#1473](https://github.com/openstack-experimental/keystone/pull/1473))
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oauth2)* Revoke refresh families on lifecycle ([#1404](https://github.com/openstack-experimental/keystone/pull/1404))
+- *(oauth2)* Cap refresh families and revalidate user ([#1360](https://github.com/openstack-experimental/keystone/pull/1360))
+- *(oauth2-session)* Add expired record janitor ([#1359](https://github.com/openstack-experimental/keystone/pull/1359))
+- *(oauth2)* Add secondary indexes to raft driver ([#1327](https://github.com/openstack-experimental/keystone/pull/1327))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(adr0026)* Add RFC 8628 Device Authorization Grant ([#1023](https://github.com/openstack-experimental/keystone/pull/1023))
+- *(adr0026)* Add authorization code flow with PKCE ([#1015](https://github.com/openstack-experimental/keystone/pull/1015))
+
+### Fixed
+
+- *(oauth2)* Clear logout relying parties atomically ([#1496](https://github.com/openstack-experimental/keystone/pull/1496))
+- *(oauth2-session)* Tombstone revoked refresh families ([#1358](https://github.com/openstack-experimental/keystone/pull/1358))
+- *(storage)* Adopt leader's DEK when nodes join ([#1328](https://github.com/openstack-experimental/keystone/pull/1328))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
diff --git a/crates/oslo-config/CHANGELOG.md b/crates/oslo-config/CHANGELOG.md
new file mode 100644
index 000000000..aa71c2d74
--- /dev/null
+++ b/crates/oslo-config/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/oslo-config-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
diff --git a/crates/password-hashing/CHANGELOG.md b/crates/password-hashing/CHANGELOG.md
new file mode 100644
index 000000000..400451a93
--- /dev/null
+++ b/crates/password-hashing/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-password-hashing-v0.1.0) - 2026-10-13
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Extract password hashing into own crate ([#1055](https://github.com/openstack-experimental/keystone/pull/1055))
diff --git a/crates/policy-store-driver-sql/CHANGELOG.md b/crates/policy-store-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..946af0c16
--- /dev/null
+++ b/crates/policy-store-driver-sql/CHANGELOG.md
@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-policy-store-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(policy)* Implement legacy Policy API (/v3/policies) ([#1127](https://github.com/openstack-experimental/keystone/pull/1127))
diff --git a/crates/resource-driver-sql/CHANGELOG.md b/crates/resource-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..9c6880078
--- /dev/null
+++ b/crates/resource-driver-sql/CHANGELOG.md
@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-resource-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(resource)* Add enabled filter to project list ([#1453](https://github.com/openstack-experimental/keystone/pull/1453))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- *(resource)* Reject project names over 64 chars ([#1455](https://github.com/openstack-experimental/keystone/pull/1455))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
diff --git a/crates/revoke-driver-sql/CHANGELOG.md b/crates/revoke-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..77fbde441
--- /dev/null
+++ b/crates/revoke-driver-sql/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-revoke-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- *(logging)* Surface 5xx causes at error level ([#1172](https://github.com/openstack-experimental/keystone/pull/1172))
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
diff --git a/crates/role-driver-sql/CHANGELOG.md b/crates/role-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..db312d3e7
--- /dev/null
+++ b/crates/role-driver-sql/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-role-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Add immutable option for project, domain, role ([#1097](https://github.com/openstack-experimental/keystone/pull/1097))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(identity)* Add PATCH to few resources ([#1076](https://github.com/openstack-experimental/keystone/pull/1076))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add role imply API ([#749](https://github.com/openstack-experimental/keystone/pull/749))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
diff --git a/crates/scim-driver-raft/CHANGELOG.md b/crates/scim-driver-raft/CHANGELOG.md
new file mode 100644
index 000000000..0d2c42cc5
--- /dev/null
+++ b/crates/scim-driver-raft/CHANGELOG.md
@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-scim-driver-raft-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- Add SCIM scenarios; Fix findings ([#1136](https://github.com/openstack-experimental/keystone/pull/1136))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- *(scim)* ADR 0024 - Phase 5 ([#951](https://github.com/openstack-experimental/keystone/pull/951))
+- *(scim)* ADR 0024 - Phase 4 (protocol surface completion) ([#929](https://github.com/openstack-experimental/keystone/pull/929))
+- *(scim)* ADR 0024 - Phase 1+2 ([#925](https://github.com/openstack-experimental/keystone/pull/925))
diff --git a/crates/storage-api/CHANGELOG.md b/crates/storage-api/CHANGELOG.md
new file mode 100644
index 000000000..2b453aae1
--- /dev/null
+++ b/crates/storage-api/CHANGELOG.md
@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-storage-api-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(storage)* Gate readiness on Raft health ([#1450](https://github.com/openstack-experimental/keystone/pull/1450))
+- *(storage)* Add ephemeral state machine records ([#1198](https://github.com/openstack-experimental/keystone/pull/1198))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(storage)* Cert validity and SVID TTL enforcement ([#886](https://github.com/openstack-experimental/keystone/pull/886))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Complete ADR-0016-v2 ([#844](https://github.com/openstack-experimental/keystone/pull/844))
+- *(storage)* implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine ([#840](https://github.com/openstack-experimental/keystone/pull/840))
+
+### Fixed
+
+- *(raft)* Fail closed on stale ReadIndex reads ([#1341](https://github.com/openstack-experimental/keystone/pull/1341))
+- *(webauthn)* Rotate raft ceremony-state keyspaces ([#890](https://github.com/openstack-experimental/keystone/pull/890))
+
+### Other
+
+- *(storage)* Split large modules and tests ([#1466](https://github.com/openstack-experimental/keystone/pull/1466))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
diff --git a/crates/storage-crypto-pkcs11/CHANGELOG.md b/crates/storage-crypto-pkcs11/CHANGELOG.md
new file mode 100644
index 000000000..bba1e2b6c
--- /dev/null
+++ b/crates/storage-crypto-pkcs11/CHANGELOG.md
@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-storage-crypto-pkcs11-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(storage)* Add PKCS#11 KEK provider crate ([#917](https://github.com/openstack-experimental/keystone/pull/917))
+
+### Other
+
+- *(storage)* Split large modules and tests ([#1466](https://github.com/openstack-experimental/keystone/pull/1466))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
diff --git a/crates/storage-crypto-tpm/CHANGELOG.md b/crates/storage-crypto-tpm/CHANGELOG.md
new file mode 100644
index 000000000..b4369e117
--- /dev/null
+++ b/crates/storage-crypto-tpm/CHANGELOG.md
@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-storage-crypto-tpm-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(storage)* Add PKCS#11 KEK provider crate ([#917](https://github.com/openstack-experimental/keystone/pull/917))
+
+### Other
+
+- *(storage)* Split large modules and tests ([#1466](https://github.com/openstack-experimental/keystone/pull/1466))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
diff --git a/crates/storage-crypto/CHANGELOG.md b/crates/storage-crypto/CHANGELOG.md
new file mode 100644
index 000000000..9f7d04018
--- /dev/null
+++ b/crates/storage-crypto/CHANGELOG.md
@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-storage-crypto-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(storage)* Gate readiness on Raft health ([#1450](https://github.com/openstack-experimental/keystone/pull/1450))
+- *(storage)* Rotate the DEK automatically ([#1441](https://github.com/openstack-experimental/keystone/pull/1441))
+- *(scim)* ADR 0024 - Phase 3 ([#928](https://github.com/openstack-experimental/keystone/pull/928))
+- *(storage)* Add PKCS#11 KEK provider crate ([#917](https://github.com/openstack-experimental/keystone/pull/917))
+- *(storage)* Cert validity and SVID TTL enforcement ([#886](https://github.com/openstack-experimental/keystone/pull/886))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Harden preflight and erase dev KEK ([#860](https://github.com/openstack-experimental/keystone/pull/860))
+- *(storage)* Complete ADR-0016-v2 ([#844](https://github.com/openstack-experimental/keystone/pull/844))
+- *(storage)* implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine ([#840](https://github.com/openstack-experimental/keystone/pull/840))
+
+### Fixed
+
+- *(storage)* Route admin RPCs to the Raft leader ([#1447](https://github.com/openstack-experimental/keystone/pull/1447))
+- *(raft)* Data durability and correctness ([#1342](https://github.com/openstack-experimental/keystone/pull/1342))
+
+### Other
+
+- *(storage)* Split large modules and tests ([#1466](https://github.com/openstack-experimental/keystone/pull/1466))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Bump deps and whitelist rustsec advisory ([#1140](https://github.com/openstack-experimental/keystone/pull/1140))
+- *(deps)* Batch update dependencies ([#875](https://github.com/openstack-experimental/keystone/pull/875))
diff --git a/crates/storage/CHANGELOG.md b/crates/storage/CHANGELOG.md
new file mode 100644
index 000000000..edf292b8f
--- /dev/null
+++ b/crates/storage/CHANGELOG.md
@@ -0,0 +1,105 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.1](https://github.com/openstack-experimental/keystone/compare/openstack-keystone-distributed-storage-v0.1.0...openstack-keystone-distributed-storage-v0.1.1) - 2026-10-13
+
+### Added
+
+- *(storage)* Transfer leadership on demote ([#1462](https://github.com/openstack-experimental/keystone/pull/1462))
+- *(storage)* Audit failed restore attempts ([#1461](https://github.com/openstack-experimental/keystone/pull/1461))
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(storage)* Gate readiness on Raft health ([#1450](https://github.com/openstack-experimental/keystone/pull/1450))
+- *(storage)* Rotate the DEK automatically ([#1441](https://github.com/openstack-experimental/keystone/pull/1441))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(audit)* Ship raft audit spool through the sink ([#1383](https://github.com/openstack-experimental/keystone/pull/1383))
+- *(raft)* Add backup restore ([#1352](https://github.com/openstack-experimental/keystone/pull/1352))
+- *(devstack)* Pilot ksm SPIFFE mTLS transport ([#1239](https://github.com/openstack-experimental/keystone/pull/1239))
+- *(storage)* Bump openraft to 0.10.0-alpha.34 ([#1230](https://github.com/openstack-experimental/keystone/pull/1230))
+- *(storage)* Add ephemeral state machine records ([#1198](https://github.com/openstack-experimental/keystone/pull/1198))
+- *(metrics)* Add shared Prometheus primitives crate ([#1186](https://github.com/openstack-experimental/keystone/pull/1186))
+- Add SCIM scenarios; Fix findings ([#1136](https://github.com/openstack-experimental/keystone/pull/1136))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- *(adr0028)* Add local-quorum-bypass emergency rotation ([#1032](https://github.com/openstack-experimental/keystone/pull/1032))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(storage)* Add PKCS#11 KEK provider crate ([#917](https://github.com/openstack-experimental/keystone/pull/917))
+- Prepare PKCS#11/TPM KEK support in storage ([#907](https://github.com/openstack-experimental/keystone/pull/907))
+- Implement background DEK re-encryption pipeline ([#898](https://github.com/openstack-experimental/keystone/pull/898))
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- *(storage)* Cert validity and SVID TTL enforcement ([#886](https://github.com/openstack-experimental/keystone/pull/886))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Harden preflight and erase dev KEK ([#860](https://github.com/openstack-experimental/keystone/pull/860))
+- *(storage)* Add SPIFFE mTLS support to Raft gRPC ([#852](https://github.com/openstack-experimental/keystone/pull/852))
+- *(cli)* Add cli storage subcommands per ADR 0016-v2 ([#850](https://github.com/openstack-experimental/keystone/pull/850))
+- *(storage)* Complete ADR-0016-v2 ([#844](https://github.com/openstack-experimental/keystone/pull/844))
+- *(storage)* implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine ([#840](https://github.com/openstack-experimental/keystone/pull/840))
+- *(mapping)* ADR-0020 phase 2 ([#807](https://github.com/openstack-experimental/keystone/pull/807))
+- *(adr)* Add updated revision of the DS ADR ([#795](https://github.com/openstack-experimental/keystone/pull/795))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Add SetIndex/RemoveIndex storage commands ([#675](https://github.com/openstack-experimental/keystone/pull/675))
+- Add basic healthcheck endpoint ([#671](https://github.com/openstack-experimental/keystone/pull/671))
+- Add metadata for raft data ([#670](https://github.com/openstack-experimental/keystone/pull/670))
+- Add transaction support for Raft storage ([#669](https://github.com/openstack-experimental/keystone/pull/669))
+- Add initial benchmarks for the storage ([#668](https://github.com/openstack-experimental/keystone/pull/668))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce raft backend for webauthn ([#658](https://github.com/openstack-experimental/keystone/pull/658))
+- Prepare raft storage promotion ([#659](https://github.com/openstack-experimental/keystone/pull/659))
+- Make raft storage available through state ([#657](https://github.com/openstack-experimental/keystone/pull/657))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(storage)* Adopt cluster DEK in storage join ([#1463](https://github.com/openstack-experimental/keystone/pull/1463))
+- *(storage)* Route admin RPCs to the Raft leader ([#1447](https://github.com/openstack-experimental/keystone/pull/1447))
+- *(storage)* Deflake removed-node assertion in test_cluster ([#1438](https://github.com/openstack-experimental/keystone/pull/1438))
+- *(tests)* Fix some test failures ([#1430](https://github.com/openstack-experimental/keystone/pull/1430))
+- *(cli-manage)* Pin admin client SVID to admin_svid ([#1428](https://github.com/openstack-experimental/keystone/pull/1428))
+- *(audit)* Polish the CADF crate ([#1424](https://github.com/openstack-experimental/keystone/pull/1424))
+- *(storage)* Authorize Raft and Storage gRPC callers ([#1418](https://github.com/openstack-experimental/keystone/pull/1418))
+- *(raft)* Rotate audit key per DEK epoch ([#1362](https://github.com/openstack-experimental/keystone/pull/1362))
+- *(audit)* Stop spool replay from looping into itself ([#1350](https://github.com/openstack-experimental/keystone/pull/1350))
+- *(raft)* Data durability and correctness ([#1342](https://github.com/openstack-experimental/keystone/pull/1342))
+- *(raft)* Fail closed on stale ReadIndex reads ([#1341](https://github.com/openstack-experimental/keystone/pull/1341))
+- *(raft)* Close DEK re-encrypt lost-update race ([#1336](https://github.com/openstack-experimental/keystone/pull/1336))
+- *(raft)* Fix emergency DEK rotation data loss ([#1334](https://github.com/openstack-experimental/keystone/pull/1334))
+- *(raft)* Guard snapshot against concurrent changes ([#1333](https://github.com/openstack-experimental/keystone/pull/1333))
+- *(raft)* Restore full state on snapshot install ([#1331](https://github.com/openstack-experimental/keystone/pull/1331))
+- *(storage)* Fix full_snapshot RPC deadlock ([#1330](https://github.com/openstack-experimental/keystone/pull/1330))
+- *(storage)* Adopt leader's DEK when nodes join ([#1328](https://github.com/openstack-experimental/keystone/pull/1328))
+- Support macOS dev builds and fs watcher shutdown ([#1009](https://github.com/openstack-experimental/keystone/pull/1009))
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+- Further polish storage crate ([#892](https://github.com/openstack-experimental/keystone/pull/892))
+- *(webauthn)* Rotate raft ceremony-state keyspaces ([#890](https://github.com/openstack-experimental/keystone/pull/890))
+- Resolve raft replication state races ([#884](https://github.com/openstack-experimental/keystone/pull/884))
+
+### Other
+
+- *(storage)* Cover bootstrap and auto-join ([#1502](https://github.com/openstack-experimental/keystone/pull/1502))
+- *(storage)* Cover crash and collision cases ([#1484](https://github.com/openstack-experimental/keystone/pull/1484))
+- *(storage)* Split large modules and tests ([#1466](https://github.com/openstack-experimental/keystone/pull/1466))
+- *(storage)* Correct operator guide and ADR ([#1465](https://github.com/openstack-experimental/keystone/pull/1465))
+- *(storage)* Cover failover and restart paths ([#1464](https://github.com/openstack-experimental/keystone/pull/1464))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(storage)* Fix flaky test_join_adopts_cluster_dek ([#1335](https://github.com/openstack-experimental/keystone/pull/1335))
+- Bump openraft version to 0.10.0.a31 ([#1137](https://github.com/openstack-experimental/keystone/pull/1137))
+- Silence some clippy warnings ([#1030](https://github.com/openstack-experimental/keystone/pull/1030))
+- *(deps)* Batch update dependencies ([#875](https://github.com/openstack-experimental/keystone/pull/875))
+- *(core)* Remove spiffe crate dependency ([#858](https://github.com/openstack-experimental/keystone/pull/858))
+- Add SpiFFE Raft integration test by skaffold ([#854](https://github.com/openstack-experimental/keystone/pull/854))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- Update raft drivers mocking ([#791](https://github.com/openstack-experimental/keystone/pull/791))
+- Add mock raft storage for unittest ([#790](https://github.com/openstack-experimental/keystone/pull/790))
+- Make core crates a workspace dependency ([#736](https://github.com/openstack-experimental/keystone/pull/736))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- *(deps)* Bump openraft to alpha17 ([#641](https://github.com/openstack-experimental/keystone/pull/641))
diff --git a/crates/storage/Cargo.toml b/crates/storage/Cargo.toml
index a17f67e74..323ef8e25 100644
--- a/crates/storage/Cargo.toml
+++ b/crates/storage/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "openstack-keystone-distributed-storage"
 description = "Keystone distributed storage based on the `openraft` and `fjall` database."
-version = "0.1.0"
+version = "0.1.1"
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
diff --git a/crates/telemetry/CHANGELOG.md b/crates/telemetry/CHANGELOG.md
new file mode 100644
index 000000000..34ccc28a5
--- /dev/null
+++ b/crates/telemetry/CHANGELOG.md
@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-telemetry-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
diff --git a/crates/token-driver-fernet/CHANGELOG.md b/crates/token-driver-fernet/CHANGELOG.md
new file mode 100644
index 000000000..c0a2094ee
--- /dev/null
+++ b/crates/token-driver-fernet/CHANGELOG.md
@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.1](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-token-driver-fernet-v0.1.1) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- Add cargo-fuzz targets ([#1130](https://github.com/openstack-experimental/keystone/pull/1130))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- Widen Fernet key index from i8 to u32 ([#1080](https://github.com/openstack-experimental/keystone/pull/1080))
+- Support macOS dev builds and fs watcher shutdown ([#1009](https://github.com/openstack-experimental/keystone/pull/1009))
+- Fix msgpack decode and auth-method encoding bugs ([#895](https://github.com/openstack-experimental/keystone/pull/895))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(api)* Harden v3 authorization and authentication coverage ([#1166](https://github.com/openstack-experimental/keystone/pull/1166))
diff --git a/crates/token-driver-jws/CHANGELOG.md b/crates/token-driver-jws/CHANGELOG.md
new file mode 100644
index 000000000..5898fd063
--- /dev/null
+++ b/crates/token-driver-jws/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-token-driver-jws-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(adr0026)* Add Phase 5 offline token verification ([#1016](https://github.com/openstack-experimental/keystone/pull/1016))
+- *(adr0026)* Add client_credentials token endpoint ([#1014](https://github.com/openstack-experimental/keystone/pull/1014))
+- *(adr0026)* Phase 1 crypto engine & JWKS endpoint ([#1011](https://github.com/openstack-experimental/keystone/pull/1011))
+- *(adr0026)* Phase 0 token abstraction and JWS driver ([#1010](https://github.com/openstack-experimental/keystone/pull/1010))
+
+### Fixed
+
+- *(deps)* Bump p256 to 0.14, unpin rand_core ([#1247](https://github.com/openstack-experimental/keystone/pull/1247))
+
+### Other
+
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- *(api)* Harden v3 authorization and authentication coverage ([#1166](https://github.com/openstack-experimental/keystone/pull/1166))
diff --git a/crates/token-restriction-driver-sql/CHANGELOG.md b/crates/token-restriction-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..d2f2429c3
--- /dev/null
+++ b/crates/token-restriction-driver-sql/CHANGELOG.md
@@ -0,0 +1,24 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-token-restriction-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- Generalize marker pagination for v3/v4 lists ([#1086](https://github.com/openstack-experimental/keystone/pull/1086))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Other
+
+- *(api)* Cover v4 handlers and fix role assignment routing ([#1153](https://github.com/openstack-experimental/keystone/pull/1153))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
diff --git a/crates/trust-driver-sql/CHANGELOG.md b/crates/trust-driver-sql/CHANGELOG.md
new file mode 100644
index 000000000..27d3d488d
--- /dev/null
+++ b/crates/trust-driver-sql/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-trust-driver-sql-v0.1.0) - 2026-10-13
+
+### Added
+
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- Auto-register backend drivers via inventory ([#1105](https://github.com/openstack-experimental/keystone/pull/1105))
+- *(identity)* Add trust create/delete and REST CRUD ([#1079](https://github.com/openstack-experimental/keystone/pull/1079))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- *(trust)* Match db fields to sINT for mysql ([#1173](https://github.com/openstack-experimental/keystone/pull/1173))
+- *(logging)* Surface 5xx causes at error level ([#1172](https://github.com/openstack-experimental/keystone/pull/1172))
+
+### Other
+
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
diff --git a/crates/webauthn/CHANGELOG.md b/crates/webauthn/CHANGELOG.md
new file mode 100644
index 000000000..fa53dfabd
--- /dev/null
+++ b/crates/webauthn/CHANGELOG.md
@@ -0,0 +1,60 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-webauthn-v0.1.0) - 2026-10-13
+
+### Added
+
+- *(oauth2)* Add WebAuthn second factor ([#1492](https://github.com/openstack-experimental/keystone/pull/1492))
+- Enable OpenTelemetry metrics and traces support ([#1456](https://github.com/openstack-experimental/keystone/pull/1456))
+- *(oslo.config)* Generalize oslo-config crate ([#1429](https://github.com/openstack-experimental/keystone/pull/1429))
+- *(raft)* Add backup restore ([#1352](https://github.com/openstack-experimental/keystone/pull/1352))
+- *(storage)* Add ephemeral state machine records ([#1198](https://github.com/openstack-experimental/keystone/pull/1198))
+- *(core)* Reconnect database connection on new config ([#1188](https://github.com/openstack-experimental/keystone/pull/1188))
+- *(test)* Add tempest identity compatibility ([#998](https://github.com/openstack-experimental/keystone/pull/998))
+- Prepare PKCS#11/TPM KEK support in storage ([#907](https://github.com/openstack-experimental/keystone/pull/907))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Harden preflight and erase dev KEK ([#860](https://github.com/openstack-experimental/keystone/pull/860))
+- Security improvements in the webauthn crate ([#838](https://github.com/openstack-experimental/keystone/pull/838))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Add metadata for raft data ([#670](https://github.com/openstack-experimental/keystone/pull/670))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce raft backend for webauthn ([#658](https://github.com/openstack-experimental/keystone/pull/658))
+
+### Fixed
+
+- *(raft)* Fail closed on stale ReadIndex reads ([#1341](https://github.com/openstack-experimental/keystone/pull/1341))
+- *(passkey)* Prevent user enumeration ([#905](https://github.com/openstack-experimental/keystone/pull/905))
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+- *(webauthn)* Rotate raft ceremony-state keyspaces ([#890](https://github.com/openstack-experimental/keystone/pull/890))
+
+### Other
+
+- *(audit)* Rename audit crate to cadf ([#1399](https://github.com/openstack-experimental/keystone/pull/1399))
+- Fix clippy lints across workspace ([#1361](https://github.com/openstack-experimental/keystone/pull/1361))
+- Extend workspace unsafe/unwrap/expect lints ([#1120](https://github.com/openstack-experimental/keystone/pull/1120))
+- *(deps)* Bump sea-orm and sea-orm-migration to 2.0 ([#1089](https://github.com/openstack-experimental/keystone/pull/1089))
+- *(deps)* Batch update dependencies ([#875](https://github.com/openstack-experimental/keystone/pull/875))
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- Update raft drivers mocking ([#791](https://github.com/openstack-experimental/keystone/pull/791))
+- Add mock raft storage for unittest ([#790](https://github.com/openstack-experimental/keystone/pull/790))
+- Make core crates a workspace dependency ([#736](https://github.com/openstack-experimental/keystone/pull/736))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- Split the core-types crate ([#640](https://github.com/openstack-experimental/keystone/pull/640))
+- Move assignment parameters resolution to driver ([#625](https://github.com/openstack-experimental/keystone/pull/625))
+- Introduce features in api-types crate ([#624](https://github.com/openstack-experimental/keystone/pull/624))
+- Split out webauthn into crate ([#621](https://github.com/openstack-experimental/keystone/pull/621))