Changelog¶

0.9.6 (2026-11-06)¶

Features¶

• admin routes and store for MCP tokens (issue 1096 step 1) (#1099) (3ce6dc1)
• guide section and docs page for ai agents (issue 1096 step 5) (#1103) (10b9c6c)
• mcp endpoint with its token gate and 20 read tools (issue 1096 step 2) (#1100) (d4bfb48)
• mcp write tools for triage and decisions (issue 1096 step 3) (#1101) (e81b7ff)
• settings section ai agents (mcp) (issue 1096 step 4) (#1102) (2858eaa)

Bug Fixes¶

• add panel puts the new panel under the others (#1091) (6018365), closes #1090

0.9.5 (2026-11-03)¶

Features¶

• a riskiest images panel takes findings filters (#1082) (7368267), closes #1063
• a triage activity panel takes audit log filters (#1083) (39d73cf)
• dashboard panels read with their own filters and show them in a corner button (#1068) (22a5b5b)
• dashboard panels store findings filters, and facets count under all filters (#1065) (11eda1f), closes #999
• the audit log and approvals filters find a user or approver past the top 32 (#1073) (b8cd6da)
• the filter menu finds a value past the top 32 (#1072) (b1dae43), closes #1064
• the panel settings set the findings filters of a panel (#1071) (bfe583a)

Bug Fixes¶

• deps: update dependency fastapi to >=0.162,<0.163 (#1078) (38993fd)
• deps: update dependency zensical to v0.0.74 (#1069) (dae3ac2)
• ingest counts findings, not the entries of the scanner report (#1080) (25612c9)

0.9.4 (2026-10-30)¶

Features¶

• kit search box, small pager dropdown and a lint rule against raw form fields (#1059) (967580f)
• release notes with a What's new section, and an STE check for them and the docs pages (#1062) (c3ee84b), closes #1061

Bug Fixes¶

• a dashboard panel holds only the cells of its top row (#1046) (4007ff7), closes #1045
• dashboard panels take the height of their content, on the read page and in edit mode (#1048) (7713485), closes #1045
• every window box uses the one kit text box and dropdown style (#1052) (4e48cb2), closes #1050
• every window head takes the dark blue band of the table heads (#1051) (61100b1), closes #1049
• the kit box and one search box outside the windows, and one pair of window footer buttons (#1054) (d912a74)

0.9.3 (2026-10-29)¶

Bug Fixes¶

• role names in words, and one height with a 1px edge in every screen head (#1041) (5feec35)

0.9.2 (2026-10-29)¶

Bug Fixes¶

• a saved card opens its item from anywhere, and its hover keeps the card white (#1037) (b88e27a)
• deps: update dependency zensical to v0.0.73 (#1035) (dec7852)

0.9.1 (2026-10-27)¶

Bug Fixes¶

• at a past time, a kev finding gets the kev sla deadline (#1026) (e5c5b55)
• each segmented control has a name for screen readers (#1029) (be6a7c6)

0.9.0 (2026-10-26)¶

This release has no code changes after 0.8.9. It marks the changes of 0.8.9 as a minor release: composable dashboards, the Roles card and the can_export permission. The notes of 0.8.9 list each change.

Documentation¶

• the memory bank after release 0.8.9, and release 0.9.0 marks its changes (#1014) (425982a)

0.8.9 (2026-10-26)¶

Features¶

• a catalog of dashboard panels, and each panel can get its own data (#996) (0553f29)
• dashboard files, an NDJSON export and an import with a result for each line (#1002) (7c9f896)
• edit a dashboard, add panels from the catalog, and share or remove it (#1010) (4c4625d)
• export controls stay visible but disabled, with the reason, for a role without can_export (#995) (230ac3b)
• owners read the role names they can share a dashboard with (#1007) (e8f6267)
• saved dashboards with sharing, revisions and the can_edit_dashboards permission (#1001) (7a2489e)
• the dashboards list and read page, with export and import of dashboard files (#1003) (78eb979)
• the export files need the can_export permission (#994) (268e778)
• the roles card is a table of each permission and the roles that have it (#993) (9713f1a), closes #990
• the roles route lists each permission with a name and what it allows (#991) (651ba95), closes #990

Bug Fixes¶

• dashboard sharing refuses a role name that no role has (#1008) (3f98e68)

0.8.8 (2026-10-23)¶

Bug Fixes¶

• a value of a fixed filter list with no rows shows 0 (#982) (da320d3)
• findings names refused filters and keeps assignee and unassigned apart (#977) (5c75987), closes #975
• the audit log counts each of its actions (#985) (7d580bd), closes #983
• the backend refuses a decision expiry that has passed, and a rotation of a dead token (#986) (c95c371), closes #984
• the screens take no expiry that has passed, rotate only live tokens, and end a range today (#987) (1e94051)
• the unassigned count leaves out the assignee values that its click clears (#981) (69165ca)

0.8.7 (2026-10-23)¶

Features¶

• findings image, cve and package filters take several typed values (#957) (190f538)
• findings namespace, package type and assignee filters take several values (#956) (de9f942)
• six findings filters take several values in the api (#953) (a003b62)
• the audit log and approvals filters take several values in the api (#960) (3886f70)
• the audit log and approvals screens take several values per filter (#963) (3df0424)
• the images filters accept several namespaces, images and tags (#951) (5a96102)

Bug Fixes¶

• a new username is lower case only, and sign-in accepts any case (#966) (b5c46f6)
• a picked username keeps its capitals in the filters (#964) (5d5323a)
• a saved view refuses the filter pairs that findings refuses (#974) (5875cd9), closes #969
• a scheduled export refuses the filter pairs that findings refuses (#970) (fa055cc), closes #962
• the helm test pod of javv-opensearch meets pod security restricted (#947) (174518c)
• the invite form says that a username is in lower case (#967) (40229b3)
• the scheduled export takes four more filters and names a blocked filter as the screen does (#971) (06adad5), closes #962

0.8.6 (2026-10-20)¶

Bug Fixes¶

• the audit log names every action and shows the values of each settings change (#934) (e5d848f)

0.8.5 (2026-10-19)¶

Bug Fixes¶

• audit changes show plain field names and the reason of each change to not affected (#932) (c9d3fb7)
• each release keeps its own docs on the docs site (#927) (463c066)
• the activity card shows a new reason as its plain label (#930) (5e507b5)
• the frontend server closes an idle backend connection before the backend does (#929) (89f8bf7)

0.8.4 (2026-10-19)¶

Features¶

• a loading bar in the top bar, and page code that loads early (#904) (a944b39)
• pages and their data come in with a short fade, and the header card stretches (#905) (72e6bbe)

Bug Fixes¶

• a finding's activity card shows a bulk change with its state and note (#917) (d7541fb)
• deps: update dependency fastapi to >=0.146,<0.147 (#923) (3542ea6)
• plain reason text, the finding page after a decision, and the revoke toast (#915) (7a872bc)
• the activity card names each action with the audit log's action pill (#920) (bb81d91)
• the audit read for one finding also returns the bulk changes that included it (#916) (766d92c)

0.8.3 (2026-10-17)¶

Features¶

• owner-kind buttons on the scan scope page, with a typed list for other kinds (#900) (cffb5d3)
• the scanner logs what the scan scope skipped in each cycle (#901) (6f9039e)

Bug Fixes¶

• deps: update dependency zensical to v0.0.71 (#893) (27f8763)
• role boundaries and credential copies from the 0.8.2 security review (backend) (#897) (8df0bf9)
• security headers and role-aware triage controls from the 0.8.2 security review (web app) (#898) (2cc12f4)

0.8.2 (2026-10-16)¶

Features¶

• deploy/compose/setup.sh makes .env with random secrets and shows the admin password once (#870) (856b5ec), closes #869
• the scanners pull images from private registries with a login that the chart mounts (#880) (d02b951)

Bug Fixes¶

• a sign-in whose cookie the browser did not keep says why, not success (#871) (669ad0c), closes #869
• bootstrap reads the mapping of an index behind an alias of the same name (#876) (e874587)
• findings and running images open with a bad stored hidden-columns value (#882) (13a09b4)

0.8.1 (2026-10-15)¶

Features¶

• the guide's section heads are bands in the table-head colors (#864) (0583a3a)

Bug Fixes¶

• a scheduled bulk triage checks its patch, at enqueue and in the drain (#855) (59a9ec4)

0.8.0 (2026-10-14)¶

Bug Fixes¶

• a 422 from a field check names the field and the reason, not the value sent (#849) (1bf192f)
• a full or red store says so, an overloaded one says busy, and readiness stays up (#843) (5858383)
• cluster delete holds for re-deletes, mints, the bring back race and the nightly pass (#834) (9a60db0)
• deps: update dependency zensical to v0.0.70 (#838) (6399aca)
• index-map has the new ingest reasons, comments explain, mints log the tombstone they end (#836) (39e4014)
• ingest refuses made-up scan orders, wrong clocks and naive times; a lost store is a 503 (#835) (c290f37)
• password changes journal first, and sign-in says when a session or a change ended (#841) (3977cdd)
• refused reads say so instead of showing an empty or stale answer (#840) (281abed)
• release workflows: syft and the self-scan grype by digest, and a re-run signs what is published (#847) (b95b16d)
• retirement notices: a shared code for the mid-delete 409, one bulk write, names in the bell, ticking fleet chips (#846) (3ba9a0e)
• serve the fonts from the app, with spline sans mono as the mono face (#827) (8130999)
• the scanner pulls the digest a pod runs, and a cycle retries for up to 6 minutes (#837) (0eeda33)
• the web app closes the searches it leaves, and Prev from the last page works (#845) (581fa8f)

Miscellaneous Chores¶

• the next release is 0.8.0, and its upgrade note says so (#853) (11ceb2d)

0.7.2 (2026-10-11)¶

Bug Fixes¶

• a fresh install can mint its first token and read its settings pages (#820) (436e91e)
• a refused read no longer reads as an empty answer (#821) (601385e)
• scan pods started by digest through the pullable image_id reference (#819) (2b0e9c2)
• the primary button presses in with a ring (#824) (373254e)

0.7.1 (2026-10-10)¶

Bug Fixes¶

• a cluster or window change waits for the navigation under way (#810) (9727c39)
• a session with a temporary password reaches only the password change, reads included (#805) (beb6ef2)
• every read checks that an ok reply's body arrived, and a lost token value says so (#813) (5eec52e)
• overview reads survive an ok reply with no body, and logged errors say where they threw (#812) (4f36248)
• the rig login helpers read with the session the password change returns (#808) (a58e788)

0.7.0 (2026-10-09)¶

Features¶

• rename JAVV_TOKEN_PEPPER to JAVV_SECRET_KEY, and fix the docs site (#795) (2a78774)

Miscellaneous Chores¶

• each release publishes its docs version and latest, and m10 closes with 0.7.0 (#798) (2d7e158)

0.6.3 (2026-10-09)¶

Bug Fixes¶

• deps: update dependency fastapi to >=0.143,<0.144 (#783) (5a23216)

0.6.2 (2026-10-08)¶

Features¶

• a countdown, a fleet chip and a bell notice before a silent cluster is retired (#777) (f6b2fcb)
• a reset command for a forgotten password when no admin can sign in (#762) (21ae542)
• delete a retired cluster, everything but its audit rows, matched by its exact id (#775) (b483e27)
• refuse bring back mid-delete, say a manual retire needs a new token, and recheck deletes (#779) (f868a07)
• retire silent clusters automatically or by hand, off the cluster list with their data kept (#768) (6579ff0)
• retire, bring back and delete clusters, and the retirement window, in settings cluster (#776) (ae186a8)
• the sign-in screen says what to do about a forgotten password (#763) (2aed81e)

Bug Fixes¶

• drop minio from the dev seed, since docker hub no longer serves its pinned tag (#767) (49a5c55)

0.6.1 (2026-10-06)¶

Bug Fixes¶

• the release smoke sets every compose secret, and the release pr gets its chart readmes (#753) (1299ad8)

0.6.0 (2026-10-06)¶

Features¶

• a release publishes the three charts to ghcr, signed (#743) (e04ab83)
• compose runs opensearch with its login on (#733) (6c5ed35)
• the backend signs in to a secured opensearch, through one client factory (#731) (de2a875)
• the backend signs in to opensearch as javv, a least-privilege role (#745) (9613caf)
• the charts create the javv user and role, and the app signs in as it (#748) (498e7a8)
• the javv chart, the backend and frontend from the compose file (#740) (db1d615)
• the javv-opensearch chart, opensearch with its login on and admin alone (#738) (1b51647)
• the javv-scanner chart, a cronjob and a vuln-db cache per scanner (#741) (63bc658)
• the release signs the app images, with an sbom attestation (#742) (6568349)

Bug Fixes¶

• compose's opensearch starts with admin as its only user (#737) (f545e9d)
• the charts ci step fails on a failed render or a missing image (#744) (6f4e336)
• the password change says the 12-character rule and why a password was refused (#727) (4a86e81)

Miscellaneous Chores¶

• cut the 0.6.0 minor release (#751) (5c572ad)

0.5.1 (2026-10-04)¶

Features¶

• a release publishes the app images, and the compose file runs them (#723) (dad731f)
• docker compose runs the whole stack on one machine, with a deploy guide (#720) (e831ce0)
• the backend image, and a setting for the session cookie's Secure flag (#716) (bbd55cf)
• the frontend image, with a server that serves the app and forwards to the backend (#718) (31a34df)

0.5.0 (2026-10-03)¶

Features¶

• a crash page inside the frame, and a static maintenance page (#688) (8f89011)
• one registry and one lease for every background job, the schedule maths and the scheduler settings (#692) (87a704f)
• the audit log opens without sign-ins, and a triage change can be undone (#686) (e03213a)
• the backend runs its own background jobs on cron schedules (#693) (f637fed)
• the Guide explains a state against a risk acceptance, and the Approval list (#700) (f0b15ba), closes #698
• the job cards on the Data inspector become one table with column headers (#696) (2a9eb30)
• the jobs route lists every background job with its schedule and health (#694) (9721e64)
• the Scheduled jobs card on the Data inspector, with a status chip per job (#695) (71c3df8)

Bug Fixes¶

• a dead backend is reported as the server, not as a wrong password or OpenSearch (#689) (a4493bb)
• an image that cannot be scanned no longer freezes the running-images view (#690) (ccc52ab)
• expiry stored in UTC, lifecycle errors fail the run, jobs list needs the inspect permission (#709) (567e73e)
• small findings from the design review (wording, headings, scope legend, empty pager) (#685) (2fa5d7c)
• stale survives decision re-projection, and token rotation no longer mass-stales (#708) (87fec5f)

Miscellaneous Chores¶

• cut the 0.5.0 minor release (#713) (01b8018)

0.4.13 (2026-10-02)¶

Bug Fixes¶

• three layout glitches (settings tabs and image detail at 1024, empty trend chart) (#682) (0b86ea5)

0.4.12 (2026-10-02)¶

Bug Fixes¶

• filters and labels say things by their display names, not the stored values (#678) (a3acb86)
• open any table row from the keyboard, through a real link on its identifier (#677) (f9fe4c1), closes #674

0.4.11 (2026-10-02)¶

Bug Fixes¶

• a page for unknown addresses, named settings inputs, and a bulk triage dialog that helps (#676) (38c8a87), closes #674
• give status its own colours, one caution amber, and ramps that read in grayscale (#673) (f9b9bfe), closes #659
• open the clicked cluster or saved view on the first click, and gate it in the smoke (#668) (60ff430), closes #666

0.4.10 (2026-10-01)¶

Bug Fixes¶

• drop internal decision codes from ui copy and say why instead (#665) (c97d998)
• no em dashes in copy, one muted hyphen for empty values, and a test that keeps it so (#661) (0b283f5), closes #652

0.4.9 (2026-10-01)¶

Bug Fixes¶

• fit every screen at 1024, 1366 and 1920, and check it in the visual rig (#658) (af5d9ff)
• say when the scanner freshness check fails instead of staying silent (#656) (4940288)

0.4.8 (2026-10-01)¶

Features¶

• add a push mode to the scanner compatibility gate (#636) (e57ee58), closes #631
• add the about page with the running stack, diagnostics and docs links (#648) (d2957f9)
• add the guide page, how to read javv, and split it from about (#653) (83180f6)
• check every scanner version's real push against the store in ci (#638) (77f3cfd), closes #631
• link the freshness banner and the ingest strip to the guide (#654) (e4b8d61)
• report the running version on /api/v1/meta and in the bootstrap log (#629) (77d5581), closes #261
• show the running versions in the sidebar footer (#635) (d626230), closes #261

Bug Fixes¶

• carry the request's id on every error response and crash log line (#645) (64a3d16)
• deps: update dependency fastapi to >=0.141,<0.142 (#626) (89240c7)
• drift-check the docs that state the supported scanner versions (#642) (64f500f)
• keep the release version out of the pinned openapi snapshot (#655) (8a81048)
• pin docker digests in dockerfiles only, not in .python-version (#618) (69e3641)
• read stored settings leniently so a rollback can read settings a newer release saved (#643) (88b595f)
• run the scanner images as a non-root user on a read-only-ready filesystem (#634) (f21d81d), closes #632

0.4.7 (2026-09-29)¶

Features¶

• sign the published scanner images with cosign keyless and attest their sboms (#611) (ab0e6d4), closes #74

0.4.6 (2026-09-27)¶

Features¶

• backend: client-events beacon endpoint with namespaced re-emit (issue 453) (#517) (0e32e0a), closes #453
• backend: count refused pushes per day per scanner (#578) (2361acc), closes #575
• backend: read one scanner's failed ingests, newest first (#573) (ca49e69), closes #357
• backend: record ingests rejected past the token check, with lifecycle retention (#572) (2109af7), closes #357
• backend: sweep expired login sessions past a grace window (#558) (4ee2ff2), closes #532
• frontend: report dropped beacon events and clip oversized field values (issue 519) (#521) (cf3f5a0)
• frontend: ship warn/error to the client-events beacon from lib/logger (issue 453) (#518) (bc44c4a)
• frontend: show each scanner's failed ingests on scanner status (#574) (53d9abd), closes #357
• frontend: show refused pushes per day under scan ingest (#579) (550e331), closes #575
• ui: recent sign-ins lens link on the users panel (issue 460 §2) (#514) (560b71f), closes #460

Bug Fixes¶

• backend: clear the stale flag once a scan confirms the finding gone (#580) (f2cc037), closes #576
• backend: drop test index templates with their indices (#581) (08782e2), closes #550
• backend: log a warning on capped and rejected paths that only bumped a metric (#562) (3722df8), closes #523
• backend: show fleet-wide audit rows on the audit log page (#561) (1dfae86), closes #559
• backend: wait out the reclaimed job in its test, and log an unrecordable job ending (#570) (e7cc2fd), closes #566
• e2e: metrics assertions fired on bodies that carried the counter (#528) (dff5243)
• frontend: guard beacon event names at build time and mark clipped values (#569) (75b61bc), closes #525
• render exception tracebacks in json logs and redact them (#590) (e71c509), closes #589

0.4.5 (2026-07-30)¶

Features¶

• approvals queue CSV export (#359, absorbing #373) (#507) (b39c410)
• contributors leaderboard CSV export (#359) (#506) (0d63037)
• package_name filter and the cve/package exclude twins (#492) (#501) (0d5933d)
• ui: click to exclude a value from the rail and the grids (#349 §2) (#491) (19697a5)

Bug Fixes¶

• backend: close the two pit-leak windows outside the reclaim guards (#512) (5cb14a1), closes #509
• backend: drain the commit race from both sides, not just the retry count (#513) (795493a), closes #510
• frontend: one csv-export path with try/finally: no more strandable buttons (issue 509) (#511) (25e794b), closes #509
• frontend: stop the dev server watching the gitignored coverage dir (#504) (ea04931), closes #502
• ui: epss and mix bar tracks move onto --meter-track (#498) (c93ce7c)
• ui: facet rail collapses long groups behind a show-all expander (#500) (ffd0544)
• ui: make the grid value bar reachable, legible and pixel-crisp (#496) (9d559fb)
• ui: the two impeccable findings: a real layout animation and a phantom (#495) (ee05668)

0.4.4 (2026-07-27)¶

Features¶

• filter findings nobody owns: the unassigned flag (#349 §1) (#488) (674cd33)
• filter negation swept to running images, the audit trail and approvals (#487) (e89ee6e)

Bug Fixes¶

• ui: five read-legibility defects: width, severity mix, dead column, bare counts, false empty states (#486) (e5aeaad)

0.4.3 (2026-07-26)¶

Bug Fixes¶

• scanner: assert the cluster reached matches JAVV_CLUSTER_ID (#472) (b51d7bb), closes #470

0.4.2 (2026-07-19)¶

Features¶

• backend: system-jobs lease guards both doors + lifecycle dry-run (#464) (9494d6a)
• ui: dry run button on the lifecycle repair row (#465) (1b99e82)

Bug Fixes¶

• ui: audit table: detail shrinks to content, target owns the slack (#462) (d733424)

0.4.1 (2026-07-18)¶

Features¶

• backend: repair-actions job surface: 202 triggers + lease/status (#406 follow-up) (af2e7fb)
• backend: repair-actions surface: trigger the sanctioned jobs over http (issue 406) (142827d), closes #406
• data inspector: read-only store console (#406) (#455) (3e2a787)
• ui: repair actions card on /inspect (#406 follow-up) (#457) (3c71b44)
• ui: topbar user menu + m9 cap-logging parity (#450) (#451) (94d2ae3)

Bug Fixes¶

• fleet-scoped events (auth, jobs, inspect) appear in the audit screen (#458) (e791625)

0.4.0 (2026-07-17)¶

Features¶

• fe: m9f slice 1: emptystate kit, zero-clusters cold start, testable nav gate (#441) (ea00e61), closes #40
• fe: m9f slice 2: ⌘K command palette (global search + jump-to-screen) (#443) (2535009)
• m9f slice 3: notification bell (poll, floating glass drawer, dismiss) + flat primary button (#444) (e60712c)
• m9f slice 4: saved views v2, is/is-not filter negation, url-rewrite ownership fix (#445) (05287b9)

Bug Fixes¶

• fe: e2e paging spec polls the first grid query: skeleton rows race the cluster fetch (#448) (d9214f3)

Miscellaneous Chores¶

• cut the 0.4.0 minor release (m9f bolt) (#449) (f2f7cc7)

0.3.11 (2026-07-17)¶

Features¶

• backend: per-cluster findings-cleanup window: override doc + per-tenant sweep (#437) (c82a57e), closes #431
• fe: cluster rides the url: global ?cluster= deep links (issue 433) (#438) (239b827), closes #433
• ui: cve detail refresh: wide layout, transposed evidence, kit cards (#434) (#439) (ed584f9)
• ui: overview drops the duplicate scan-activity card for top-components + riskiest-images (#426) (f258a6d)
• ui: section identity accents, scanner identity dots, slate table-head band (#428) (3aa68de)

Bug Fixes¶

• fe: clear grid rows on cluster/T switch: stale-tenant rows lingered under slow networks (#436) (a39863f), closes #431

0.3.10 (2026-07-16)¶

Features¶

• api: team totals block on the contributors read (#360) (1096ef4)
• backend: approvals rail filters + facets on the queue endpoint (4b) (#371) (d82d81f), closes #38
• backend: sla_clock_at: the materialized d21 group clock (issue 363, pr 1/2) (#365) (1d92235), closes #363
• jobs: findings long-window cleanup sweep: m9e slice 5, bolt wrap (#412) (fd47ed4), closes #39
• scanner: namespace scope lists take fnmatch globs (#409) (fc7eba4), closes #39
• ui: approvals filter rail (m9d slice 4b, frontend) (#372) (a74b4bb), closes #38
• ui: m9d slice 1: the audit log on the prototype table grammar (#353) (20b511c)
• ui: m9d slice 2: scanner status on the shared data-screen grammar (#356) (e8c0529)
• ui: m9d slice 3: contributors on the shared data-screen grammar (#361) (6f72897), closes #38
• ui: m9d slice 4: approvals review queue on the shared grammar (#370) (a1a66bb), closes #38
• ui: m9e slice 1: settings shell + SLA policy panel (#405) (b8b672e)
• ui: m9e slice 2: tokens, users & roles, cluster panels (#407) (252675b)
• ui: m9e slice 3: scan-scope editor + scanning panel (#408) (3046502)
• ui: m9e slice 4: data & opensearch panel + live freshness banner (#411) (dcd96bf)
• ui: sla-breached attribute chip on the findings rail (issue 363, pr 2/2) (#366) (d6fb096), closes #363

Bug Fixes¶

• backend: historical export reconstructs the cluster once (audit f-09) (#397) (fda2990)
• backend: historical reads page to exhaustion, never a 10k cap (audit f-05/f-06) (#392) (8de360b)
• backend: jobs read to exhaustion: no 10k caps in rebuild/staleness (#391) (#396) (863a6ab)
• backend: one id for a notification's _id and notification_id (audit f-03/f-13) (#390) (25aa1e8)
• backend: report status + download are owner-scoped (audit f-01/f-12) (#388) (d4a4238)
• ui: export dialog carries the whole lens + past-t schedules (audit f-07/f-08/f-11) (#393) (100737a)
• ui: image csv export is an authenticated read, not admin-only (audit f-10) (#395) (7a93781)
• ui: lenses never flash the amber quiet claim before data lands (#355) (532f077), closes #38
• ui: neutralize formula heads in the image csv export (audit f-02) (#389) (d0279f0)
• ui: rewound time chip names the viewed T from t itself (#364) (04dbc7d)
• ui: sla countdowns measure from the rewound t, never from today (#362) (a6acdc5)

0.3.9 (2026-07-11)¶

Features¶

• ui: chip language A: derived hues, severity escalation, one depth treatment (#350) (229a728)
• ui: grid ergonomics: column drag-reorder on findings + images, cursor contract, first-seen column (#348) (a24e768)

Bug Fixes¶

• api: cap hourly trend buckets at a month of span (#346) (a562b1e), closes #343

0.3.8 (2026-07-11)¶

Features¶

• api: severity split on the findings trend (#333) (77801c6)
• ui: m9c slice 1: the overview dashboard (#332) (406dedf), closes #37
• ui: M9c slice 2: the all-clusters fleet view (#338) (bcf7485)
• ui: M9c slice 3: running images + image detail on the committed inventory (#339) (4312607)
• ui: overview 1b: severity lens, signal band, at-rest affordances (#334) (486e2ae), closes #37
• ui: scan-ingest lens above the findings + images tables (#340) (95eaa2f), closes #37

Bug Fixes¶

• ui: audit-343 wave: honest errors, restorable time range, semantics everywhere (#344) (19d3dfb), closes #343
• ui: freshness banner: urgency treatment, 24h times, durations, 10-min poll (#330) (7e1c991)
• ui: overview + findings polish: cursor, donut links, palette, note, column diet (#335) (ae706ce)
• ui: system-default cursor truly global: universal rule + ratchet (#337) (023f19b), closes #37

0.3.7 (2026-07-10)¶

Features¶

• ui: collapsible icon-rail sidebar (226px ↔ 64px, Nuxt UI grammar) (#320) (cff81a3), closes #319
• ui: motion layer: open/close transitions baked into the kit (#323) (fcd1552)
• ui: toast notifications: the app-wide confirmation channel (#324) (8bfed97), closes #319

Bug Fixes¶

• audit: activity feed updates without a page reload (#321) (ee51640)

0.3.6 (2026-07-10)¶

Features¶

• dx: agent design contract, style ratchet, /visual-test + /qa commands (#285) (f8b2cfb), closes #284
• m9a: app shell, login + must_change, banners, global time picker (slice 3) (#289) (8c915ad)
• m9a: frontend scaffold, design tokens, style gates, fe logger (slice 1) (#287) (59f6428)
• m9a: reusable filter module: one fields config drives rail + bar (slice 4) (#290) (bfb3a95)
• m9a: typed api client + i4/i7 contract gate (slice 2) (#288) (55e70ac), closes #35
• m9b: bulk triage, export dialog, metadata pack: slice 4 (bolt wrap) (#309) (e115d18)
• m9b: finding detail screen: per-scanner evidence, images affected, cve-click navigation (slice 2) (#304) (c4eb6f0)
• m9b: shared chip set + lazy findings grid (slice 1) (#292) (ed40437)
• m9b: triage panel: 6-state vex, risk-accept dialog, decisions card (slice 3) (#305) (0af963f)
• prototype-fidelity time picker + columns menu on the findings grid (#297) (aeb92ec), closes #296
• switch ui font to hanken grotesk (operator a/b ruling) (#295) (eb89282)
• ui: interaction feedback + spacing rhythm + surface elevation pass (#307) (9b81c83)

Bug Fixes¶

• m9b: as_of reader rejects q explicitly; parity guard against ignored filters (#310) (f6c5936)
• ui: visible hover feedback on every control + unclipped segmented bars (#314) (662c00c)
• wcag aa contrast for hint text, dark-chrome labels and teal text (#294) (5aee72b)

0.3.5 (2026-07-08)¶

Features¶

• 274: full-word canonical severity: severity_canonical query key + sla fix (slice 1) (#277) (5a74dc8), closes #274
• 274: scanner full-word severities + count-column shim, smoke vocabulary pin (slice 2) (#278) (7c8ffb8), closes #274
• m8e: system-views store + create/list: the saved-views foundation (slice 1) (#273) (050b23a), closes #242
• m8e: views mutations: owner-or-admin, cas, and the deep-link round-trip (slice 2) (#276) (b7e80da), closes #242

Bug Fixes¶

• trends: absolute window bounds: kill the createWeight now-datemath ci flake (#279) (fd81951)

0.3.4 (2026-07-08)¶

Features¶

• m8c: audit read + catalog-first scanner provenance (slice 1) (#267) (b5d322b), closes #240
• m8c: running-images read + cluster registry: the m9-prep reads close (slice 2) (#269) (#270) (73ef41b), closes #240
• m8d: ptype through every read surface: filter, facets, groups, as-of-t (slice 2) (#272) (dea5136), closes #241
• m8d: ptype through the write path: envelope v4 with a v3 acceptance window (slice 1) (#271) (9ee1fea), closes #241

0.3.3 (2026-07-07)¶

Features¶

• m8a: inventory commit manifest + cycle-end certification (slice 2) (#256) (1ace495), closes #33
• m8a: per-scan occurrence snapshots appended in the d39 spine (slice 1) (#254) (c2b16df), closes #33
• m8a: rebuild-state scanner-presence arm + exact self-heal floor (slice 3) (#258) (c27f36f)
• m8b: audit replay + decisions-active-at-t: the human dimension (slice 2) (#264) (2a091ee)
• m8b: r-catalog point-in-time primitives (slice 1) (#263) (36670d7), closes #34
• m8b: the as-of-t reader: findings page/facets/groups reconstructed (slice 3) (#265) (29f735a), closes #34
• m8b: trends + contributors at t, reader registration, export unpark (slice 4) (#266) (da961e8)

Bug Fixes¶

• ci: allow fs.read=.. in the scanner-images bake: buildx runner drift enforces entitlements (#260) (7e2a0ec)

0.3.2 (2026-07-07)¶

Features¶

• m7: bulk_triage report kind: capability-gated, frozen at enqueue (slice 5) (#252) (6c4c442), closes #32
• m7: drain worker, chunked results, signed download, notifications bell (slice 3) (#248) (83ca734), closes #32
• m7: occ claim + fenced lease for the report queue (slice 2) (#246) (8a7d71b), closes #32
• m7: ttl + orphan sweep for the report queue (slice 4) (#251) (b7b99d7), closes #32

Bug Fixes¶

• ci: serialize the store-exclusive admin demote race: it 401'd concurrent tests (#250) (49ce86a), closes #245

0.3.1 (2026-07-07)¶

Features¶

• expand /metrics: request histogram, os health, cas churn, limits, auth (audit #220) (#229) (101c009), closes #66
• m6: scanner-freshness read: get /api/v1/scanners/freshness (audit d-1, #218) (#227) (1aab7a1), closes #35
• m7: scheduled-export queue foundation: indexes + enqueue endpoint (slice 1, #32) (#213) (a5d714d)
• validate settings at boot: borked config crash-loops readably (audit #219) (#228) (f0a44e4), closes #66

0.3.0 (2026-07-06)¶

Features¶

• m5c: warn when reproject drains a conflict storm (audit #186 nicety) (#201) (ae0c17e)

Bug Fixes¶

• m5c: journal-first audit completeness on new write paths + last-admin race (audit #188) (#204) (cba3987)
• m5c: reproject_cve guarded RMW: drain conflicts, re-check ownership (audit #186) (#197) (87bf402)
• m5d: exact paged-composite group clock, no sibling truncation (audit #187) (#200) (dc1c728)
• m6: bound export/read-path DoS: bulk sync + export/PIT caps (audit #189) (#206) (7ac2ff1)
• m6: contributors: count decision rows + page handling rows (audit #190) (#207) (582125f)
• m6: hardening & hygiene batch: reserved usernames, redaction, purl, docs (audit #192) (#210) (048687f)
• m6: read-path robustness: cursor errors 4xx + drop read-side refresh (audit #191) (#209) (1cfe3ee)

Miscellaneous Chores¶

• cut the 0.3.0 minor release (audit wave) (#211) (c8d3251)

0.2.16 (2026-07-06)¶

Bug Fixes¶

• m5c/m6: validate triage + decision vocabularies (audit #185) (#195) (b371923)

0.2.15 (2026-07-05)¶

Features¶

• m6: csv + vex export and the as-of-t dispatcher seam (slices 5-7) (#181) (f8393fa)

0.2.14 (2026-07-05)¶

Features¶

• logging: structured per-request line: method/path/status/duration_ms fields (#178) (215b684), closes #156
• m6: contributors: audit-log leaderboard, ttr, sla-hit % (slice 4) (#177) (70c6824), closes #31

0.2.13 (2026-07-05)¶

Features¶

• m6: trends: committed scans by cardinality(commit_key) + new/resolved series (slice 3) (#175) (231eb34), closes #31

0.2.12 (2026-07-05)¶

Features¶

• m6: faceted findings search: PIT cursor paging + overdue decoration (slice 1) (#170) (c3ea427), closes #31
• m6: scanner-faceted aggregations + composite group paging (slice 2) (#172) (cf2793c)

0.2.11 (2026-07-05)¶

Bug Fixes¶

• m6: ingest stamp conflict 500 + the #117 refresh measurement bench (#168) (9b0d75e)

0.2.10 (2026-07-05)¶

Features¶

• m5d: SLA/overdue + bulk triage + risk-accept approval list (#165) (0f30705)

0.2.9 (2026-07-05)¶

Features¶

• m5c: decisions & projection: precedence ladder, D22 gate, reproject triggers, rebuild-state (#163) (f3bb822)

0.2.8 (2026-07-05)¶

Features¶

• observability: shared logging lib, log levels, OpenSearch touch visibility (#159) (cdb1fce)

0.2.7 (2026-07-05)¶

Features¶

• audit: task d - admin user/role management (fr-18) (#151) (7b0a8ea), closes #141

Bug Fixes¶

• audit: task a - triage/audit correctness (m-1, m-2, m-3) (#148) (960e117), closes #138
• audit: task c - auth hardening bundle (#152) (2ac20d6), closes #140
• audit: task e - token admin polish (#153) (5b72c2c), closes #142
• audit: task f - lifecycle/jobs robustness (#154) (4fa71a1), closes #143

0.2.6 (2026-07-04)¶

Features¶

• m5b: FR-7 state machine + the structured audit writer (slices 1–2) (#133) (6f56ca7)
• m5b: triage service/route + decision lifecycle (slices 3–4) (#136) (6b8516d)

0.2.5 (2026-07-04)¶

Features¶

• m5a: auth foundation: argon2id passwords + server-side sessions (slices 1–2) (#127) (dc0f79b)
• m5a: login/logout + lockout + bootstrap admin + capability RBAC (slices 3–4) (#129) (8334ceb)
• m5a: tenant chokepoint + standing RBAC/IDOR suite + token admin + auth auditing (slices 5–6) (#130) (8a54f94)

0.2.4 (2026-07-04)¶

Features¶

• m4: scanner-disagreement flags: severity + count pair (D5a/D5b, slice 3) (#124) (6dbdf7d), closes #26
• m4: write aliases + lifecycle sweep: rollover & per-cluster retention (slices 1–2) (#122) (4631eca)

0.2.3 (2026-07-03)¶

Features¶

• m3: backend-allocated scan_order: D45, slice 1 of M3 (#103) (8719ac6), closes #25
• m3: partial-doc merge: human triage survives rescans (D31, slice 2) (#105) (0080150), closes #25
• m3: per-digest watermark CAS: the create+update guard (D40, slice 3) (#106) (f5e217e), closes #25
• m3: reconcile-on-commit: resolved CVEs leave the now grid (D37/D38, slice 5) (#107) (a4e4bd5), closes #25
• m3: two-timer staleness sweep: flag data the scanner stopped refreshing (D20, slice 6) (#108) (8972f2e)

Bug Fixes¶

• m3: audit follow-ups (M-1/M-4, m-1/m-3/m-4/m-5/m-7) (#119) (299a56f)

0.2.2 (2026-07-02)¶

Features¶

• stamp effective_config on the envelope: schema v3 (D44/FR-25) (#101) (9f8331c), closes #91

Bug Fixes¶

• scanner: stamp trivy vuln-DB provenance via a per-cycle version call (#99) (5affa4a), closes #96

0.2.1 (2026-07-02)¶

Features¶

• M2 snapshot/restore: durability early (#88) (cd110fe)
• scanner: env-configurable Trivy/Grype scan flags (#91 phase 1) (#92) (fa65374)
• UI-configurable scan scope via system-config (#94, D43/FR-24) (#95) (8c26032)

0.2.0 (2026-07-02)¶

Features¶

• backend: hardened ingest endpoint + full-envelope contract (M1 slice 3) (#83) (a5d9a5d), closes #23
• backend: M1 skeleton: app factory, lifespan, health, error envelope (#76) (4b1eb04), closes #23
• backend: observability + CI OpenSearch service: M1 complete (#85) (b97ffcf), closes #23
• backend: versioned index bootstrap (M1 slice 2) (#82) (ab15c79)
• wire scanner auth to the ingest endpoint + token-mint CLI (e2e proven) (#84) (97ad07c)

0.1.2 (2026-07-01)¶

Features¶

• scanner: stamp observed topology on the envelope (schema v2) (#77) (8a2db1b), closes #23

0.1.1 (2026-07-01)¶

Bug Fixes¶

• scanner: isolate per-image scan failures + retrospective follow-ups (#71) (44d5072)

0.1.0 (2026-06-30)¶

Features¶

• M0 scanner package (discovery, adapters, normalize, envelope, push) (#58) (3f41eaf)
• M0b: scanner image publish + compatibility CI (#63) (f4002cf)

Bug Fixes¶

• correct tool-version probe (only kubectl/helm reject --version) (#47) (baa6422)
• setup-dev node install fails as root ($SUDO -E) (cc34c17)